CVE-2026-0787: ALGO 8180 IP Audio Alerter SAC Command Injection Leading to Remote Code Execution
ALGO 8180 IP Audio Alerter devices contain an OS command injection flaw in the SAC module, as described by the ZDI advisory and NVD. The record describes remote code execution without authentication, and NVD scores the issue 9.8 (critical). No CISA KEV listing or confirmed exploitation appears in the sources consulted.
Overview
The Zero Day Initiative advisory ZDI-26-009 and the NVD record describe a command injection flaw in the SAC module of the ALGO 8180 IP Audio Alerter. According to the record, a user-supplied string is used in a system call without proper validation, which can allow code execution in the context of the device.
Impact
- The record describes remote code execution in the context of the device, with no authentication required.
- NVD lists a CVSS score of 9.8 (critical). ZDI lists a score of 8.1.
- The SSVC technical impact is listed as total.
Affected products and versions
- ALGO 8180 IP Audio Alerter, version 5.5.
- Algosolutions 8180 Ip Audio Alerter Firmware, version 5.5.
The record does not list any fixed version. This does not mean no fix exists; it means the sources consulted do not state one.
Exploitation status
CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The SSVC exploitation value is listed as none and automatable as no. The EPSS probability is 0.01388.
Remediation and mitigation
- Check with the vendor for firmware updates for the affected product line and apply them as soon as they are available.
- Keep the device off untrusted networks and limit its network exposure through segmentation and firewall rules.
- Restrict access to administrative and control interfaces to known hosts.
- Follow the ZDI advisory and the NVD entry for updates.
Detection guidance
- Review device logs and network traffic for connections from unexpected or untrusted sources.
- Watch for unplanned configuration changes or abnormal device behavior.
- Maintain an inventory to confirm which devices run the listed version.
Limitations of the available information
The record provides no fixed version, no vendor advisory text, and no technical details beyond the high-level description. Version coverage is limited to 5.5 as listed. The EPSS date in the record is later than the publication date, so this analysis does not rely on that score's timing.
Frequently asked questions
What is CVE-2026-0787?
It is a command injection flaw in the SAC module of the ALGO 8180 IP Audio Alerter. According to the record, it can allow remote code execution without authentication.
Is this vulnerability known to be exploited in the wild?
CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted for this analysis.
Which versions are affected?
The record lists version 5.5 for both the ALGO 8180 IP Audio Alerter and its firmware entry. No fixed version is listed in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.