CVE-2026-0786

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0786", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-01-08T22:55:25.980Z", "datePublished": "2026-01-23T03:01:05.200Z", "dateUpdated": "2026-01-23T19:46:44.147Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:01:05.200Z"}, "title": "ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability", "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the SCI module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28295."}], "affected": [{"vendor": "ALGO", "product": "8180 IP Audio Alerter", "versions": [{"version": "5.5", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-008/", "name": "ZDI-26-008", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:55:26.002Z", "datePublic": "2026-01-09T15:55:00.212Z", "source": {"lang": "en", "value": "Vera Mensa of Claroty Research - Team82"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T19:46:31.677200Z", "id": "CVE-2026-0786", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:46:44.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T19:46:31.677200Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:46:39.251Z"}}], "cna": {"title": "ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability", "source": {"lang": "en", "value": "Vera Mensa of Claroty Research - Team82"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ALGO", "product": "8180 IP Audio Alerter", "versions": [{"status": "affected", "version": "5.5"}], "defaultStatus": "unknown"}], "datePublic": "2026-01-09T15:55:00.212Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-008/", "name": "ZDI-26-008", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:55:26.002Z", "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the SCI module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28295."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:01:05.200Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0786", "state": "PUBLISHED", "dateUpdated": "2026-01-23T19:46:44.147Z", "dateReserved": "2026-01-08T22:55:25.980Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-01-23T03:01:05.200Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "8180 IP Audio Alerter", "vendor": "ALGO", "versions": [{"status": "affected", "version": "5.5"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:algosolutions:8180_ip_audio_alerter_firmware:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "853BF5C9-122B-4F47-9CE7-DA3E307130ED", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:algosolutions:8180_ip_audio_alerter:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A20E73F-D499-4973-ADDE-8B702E6F5254", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the SCI module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28295."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos SCI y ejecuci\u00f3n remota de c\u00f3digo en ALGO 8180 IP Audio Alerter. Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en instalaciones afectadas de dispositivos ALGO 8180 IP Audio Alerter. Se requiere autenticaci\u00f3n para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro del m\u00f3dulo SCI. El problema resulta de la falta de validaci\u00f3n adecuada de una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del dispositivo. Fue ZDI-CAN-28295."}], "id": "CVE-2026-0786", "lastModified": "2026-06-17T10:11:22.830", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0786", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T19:46:31.677200Z", "version": "2.0.3"}}]}, "published": "2026-01-23T04:16:06.180", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-008/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T18:57:38.350495+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware update released by ALGO that addresses the SCI command injection flaw.", "If a patch is not yet available, disable the SCI module or restrict its network accessibility to trusted hosts only.", "Ensure the device uses strong, unique credentials and consider changing or disabling default passwords to reduce the likelihood of an authenticated attacker."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "ALGO Solutions\u2019 8180 IP Audio Alerter devices, including firmware version 5.5, are affected by the command injection flaw.", "description_and_impact": "The flaw allows a remote attacker to inject an operating system command through the SCI module, enabling execution of arbitrary code on the device. The vulnerability arises because user\u2011supplied strings are passed directly to a system call without validation. Because the attacker must authenticate, the exposure is limited to users with valid credentials, but the resulting code execution grants the attacker the same privileges as the device process.", "risk_and_exploitability": "With a CVSS score of 8.8, the vulnerability is deemed high severity. The EPSS score of <1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network because authentication is required to send the malicious command. Attackers would need valid device credentials to trigger the flaw, but once authenticated they could control the device\u2019s operating system and potentially elevate their damage."}}}}, "created": "2026-01-23T10:26:48.576866+00:00", "updated": "2026-04-18T19:00:08.045152+00:00", "vendors": ["algo", "algo$PRODUCT$8180_ip_audio_alerter"]}