Cyber Posture

CVE-2026-0796

High

Published: 23 January 2026

Published
23 January 2026
Modified
13 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 59.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The…

more

specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28322.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and error handling of user-supplied inputs at the web UI to prevent command injection into system calls.

AC-6 Least Privilege partial match
prevent

Enforces least privilege on web UI processes to limit the scope and impact of arbitrary code execution on the device.

SI-4 System Monitoring partial match
detect

Monitors system execution for anomalous activities, such as unauthorized system calls from command injection exploits.

Security SummaryAI

CVE-2026-0796 is a command injection vulnerability within the web-based user interface of ALGO 8180 IP Audio Alerter devices, enabling remote code execution. The flaw arises from insufficient validation of user-supplied strings before they are used in system calls, as classified under CWE-78. It affects installations of these devices and was published on 2026-01-23 with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An authenticated remote attacker with low privileges can exploit this vulnerability by injecting malicious input into the web UI, leading to arbitrary code execution in the context of the device. Successful exploitation grants high-impact control over confidentiality, integrity, and availability, potentially allowing full compromise of the affected IP audio alerter.

The Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-018/ provides details on the vulnerability, originally canonized as ZDI-CAN-28322.

Details

CWE(s)
CWE-78

Affected Products

algosolutions
8180 ip audio alerter firmware
5.5

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of a public-facing web UI (T1190) via command injection (T1059.004: Unix Shell) for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References