CVE-2026-0788

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0788", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-01-08T22:55:33.353Z", "datePublished": "2026-01-23T03:01:12.802Z", "dateUpdated": "2026-01-23T19:41:10.814Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:01:12.802Z"}, "title": "ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability", "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a target user's privileges on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the functionality for viewing the syslog. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-28298."}], "affected": [{"vendor": "ALGO", "product": "8180 IP Audio Alerter", "versions": [{"version": "5.5", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-010/", "name": "ZDI-26-010", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:55:33.379Z", "datePublic": "2026-01-09T15:55:14.793Z", "source": {"lang": "en", "value": "Vera Mensa of Claroty Research - Team82"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T19:40:59.688076Z", "id": "CVE-2026-0788", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:41:10.814Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0788", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T19:40:59.688076Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T19:41:06.930Z"}}], "cna": {"title": "ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability", "source": {"lang": "en", "value": "Vera Mensa of Claroty Research - Team82"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "ALGO", "product": "8180 IP Audio Alerter", "versions": [{"status": "affected", "version": "5.5"}], "defaultStatus": "unknown"}], "datePublic": "2026-01-09T15:55:14.793Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-010/", "name": "ZDI-26-010", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-01-08T22:55:33.379Z", "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a target user's privileges on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the functionality for viewing the syslog. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-28298."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-01-23T03:01:12.802Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0788", "state": "PUBLISHED", "dateUpdated": "2026-01-23T19:41:10.814Z", "dateReserved": "2026-01-08T22:55:33.353Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-01-23T03:01:12.802Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "8180 IP Audio Alerter", "vendor": "ALGO", "versions": [{"status": "affected", "version": "5.5"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:algosolutions:8180_ip_audio_alerter_firmware:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "853BF5C9-122B-4F47-9CE7-DA3E307130ED", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:algosolutions:8180_ip_audio_alerter:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A20E73F-D499-4973-ADDE-8B702E6F5254", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a target user's privileges on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the functionality for viewing the syslog. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-28298."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Scripting Persistente en la UI web de ALGO 8180 IP Audio Alerter. Esta vulnerabilidad permite a atacantes remotos ejecutar solicitudes web con los privilegios de un usuario objetivo en instalaciones afectadas de dispositivos ALGO 8180 IP Audio Alerter. No se requiere autenticaci\u00f3n para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe dentro de la funcionalidad para ver el syslog. El problema resulta de la falta de validaci\u00f3n adecuada de los datos proporcionados por el usuario, lo que puede llevar a la inyecci\u00f3n de un script arbitrario. Un atacante puede aprovechar esta vulnerabilidad para interactuar con la aplicaci\u00f3n en el contexto del usuario objetivo. Fue ZDI-CAN-28298."}], "id": "CVE-2026-0788", "lastModified": "2026-06-17T10:11:23.050", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0788", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T19:40:59.688076Z", "version": "2.0.3"}}]}, "published": "2026-01-23T04:16:06.447", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-010/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:24:15.731649+00:00", "value": {"mitigation_remediation": ["Upgrade the device firmware to the latest version provided by ALGO Solutions that addresses the embedded XSS flaw", "If a firmware update is unavailable, restrict external access to the web interface by placing the device behind a firewall or VPN so that only trusted administrators can reach it", "Monitor and audit web logs for unexpected script entries and periodically review the syslog viewing feature to ensure no client\u2011side scripts are being executed"], "summary": {"action": "Immediate Patch", "impact": "Persistent Cross\u2011Site Scripting with User Privilege Elevation"}, "threat_synthesis": {"affected_systems": "Devices running ALGO Solutions 8180 IP Audio Alerter, particularly firmware versions around 5.5. The affected hardware includes the 8180 model with firmware 5.5, as identified in the product\u2019s CPE listings. Newer firmware releases may contain the fix, but legacy devices remain vulnerable.", "description_and_impact": "The vulnerability is a persistent XSS flaw in the syslog viewing function of the ALGO 8180 IP Audio Alerter web interface. It stems from missing validation of user\u2011supplied data and allows an attacker to inject arbitrary scripts, which the browser will execute in the context of the target user\u2019s session. This can lead to theft of session cookies, unauthorized requests, or other actions performed with the target user\u2019s privileges.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% reflects a low likelihood of exploitation as of the last assessment. The flaw does not require authentication; it can be triggered by any remote user through the web UI. While the attack requires only a web request, the potential for persistent script execution grants attackers an opportunity to compromise the session of any logged\u2011in user, potentially affecting confidentiality, integrity, and availability of the system. The vulnerability is not yet listed in the CISA KEV catalog, suggesting no widely known exploitation at this time."}}}}, "created": "2026-01-23T10:26:55.556446+00:00", "updated": "2026-04-18T03:30:25.910053+00:00", "vendors": ["algo", "algo$PRODUCT$8180_ip_audio_alerter"]}