CVE Intelligence
Analysis AI-assisted

CVE-2026-0791: ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow RCE

CVE-2026-0791 is a stack-based buffer overflow in the ALGO 8180 IP Audio Alerter, triggered through the Replaces header of SIP INVITE requests. The record states that authentication is not required and that NVD scores the issue 9.8 under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-0791 affects the ALGO 8180 IP Audio Alerter. According to the Zero Day Initiative advisory, the flaw is in how the device processes the Replaces header of SIP INVITE requests, where user-supplied data is copied into a fixed-length stack buffer without a proper length check. The record classifies the weakness as CWE-787 (Out-of-bounds Write).

Impact

  • The record states that a remote attacker can execute arbitrary code in the context of the device.
  • The record states that no authentication is required.
  • NVD assigns CVSS 3.1 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. ZDI lists 8.1 under CVSS 3.0 for its own assessment.
  • Inference: a compromised device on a voice network could be used as a foothold for further activity, but the sources do not describe downstream effects.

Affected products and versions

  • ALGO 8180 IP Audio Alerter, version 5.5.
  • Algosolutions 8180 Ip Audio Alerter Firmware, version 5.5.
  • The record does not give a range of affected versions, so earlier or later builds cannot be confirmed as affected or unaffected from this data.

Exploitation status

  • CISA KEV does not list this CVE (kev.listed is false).
  • No confirmed exploitation appears in the sources consulted.
  • SSVC in the record reports exploitation as none and automatable as no.
  • EPSS shows a probability of 0.00877 and a percentile of 0.58645. The EPSS date in the record is later than the publication date, so this value should be checked against the live EPSS source.

Remediation and mitigation

  • The record lists no fixed version. Check with ALGO Solutions and the ZDI advisory for vendor firmware guidance before concluding that a fix exists.
  • Until a fix is confirmed, limit exposure of SIP signalling from the device to trusted networks and voice gateways.
  • Segment IP audio and VoIP devices from general user networks and the internet.
  • Review whether SIP ports on these devices are reachable from untrusted zones and remove unnecessary exposure.

Detection guidance

  • Monitor SIP traffic at network boundaries for unexpected or malformed INVITE requests from untrusted sources.
  • Watch device logs for unexpected restarts, crashes, or configuration changes, which can indicate abnormal behaviour.
  • Keep an inventory of all ALGO 8180 devices and their firmware versions to speed up response once vendor guidance is available.

Limitations of the available information

  • The record does not name a fixed version, a patch, or a vendor advisory beyond the ZDI reference.
  • The affected version range is limited to the single listed version 5.5.
  • The two CVSS scores differ by CVSS version and provider, and the record does not explain the difference.
  • No exploitation evidence was found in the sources consulted, but that does not rule out exploitation.

Frequently asked questions

Is CVE-2026-0791 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted. The record also reports SSVC exploitation as none.

Which version is listed as fixed?

The record does not list any fixed version. Check with ALGO Solutions and the ZDI advisory for vendor guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.