Cyber Posture

CVE-2026-0795

High

Published: 23 January 2026

Published
23 January 2026
Modified
18 February 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0081 74.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The…

more

specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28321.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the lack of proper validation of user-supplied strings before executing system calls in the web UI, preventing command injection.

prevent

Requires timely remediation of the specific command injection flaw through patching, eliminating the vulnerability.

prevent

Enforces least privilege on web UI processes, limiting the scope and impact of arbitrary code execution even if injection succeeds.

Security SummaryAI

CVE-2026-0795 is a command injection vulnerability in the web-based user interface of ALGO 8180 IP Audio Alerter devices, enabling remote code execution. The flaw arises from insufficient validation of user-supplied strings before they are used in system calls, allowing attackers to inject and execute arbitrary commands. Published on 2026-01-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

An authenticated remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary code in the context of the device, potentially leading to full compromise including high impacts on confidentiality, integrity, and availability.

The Zero Day Initiative advisory ZDI-26-017 provides details on this issue, originally canonized as ZDI-CAN-28321. Security practitioners should review this reference for recommended mitigations and any available patches.

Details

CWE(s)

Affected Products

algosolutions
8180 ip audio alerter firmware
5.5

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Command injection in web-based UI of network device enables remote exploitation of public-facing application (T1190) and arbitrary OS command execution via command interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References