CVE-2026-0784
Published: 23 January 2026
Summary
CVE-2026-0784 is a high-severity OS Command Injection (CWE-78) vulnerability in Algosolutions 8180 Ip Audio Alerter Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0784 is a command injection vulnerability within the web-based user interface of ALGO 8180 IP Audio Alerter devices, enabling remote code execution. The flaw arises from insufficient validation of user-supplied strings before they are used in system calls, allowing attackers to inject and execute arbitrary commands. This issue affects installations of the ALGO 8180 IP Audio Alerter and is classified under CWE-78 (OS Command Injection), with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Authenticated remote attackers with low privileges can exploit this vulnerability over the network with no user interaction required. Successful exploitation allows execution of arbitrary code in the context of the device, granting high-impact access to confidentiality, integrity, and availability.
The Zero Day Initiative published advisory ZDI-26-006 detailing the vulnerability, available at https://www.zerodayinitiative.com/advisories/ZDI-26-006/. It was canonically reported as ZDI-CAN-28293.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4462
Vulnerability details
ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The…
more
specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28293.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web-based UI of network device enables exploitation of public-facing application (T1190) and arbitrary OS command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the core flaw by requiring validation of user-supplied inputs before they are used in system calls, preventing command injection.
Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability through patching and updates.
Enforces least privilege to limit the impact of arbitrary code execution by ensuring the web UI process runs with minimal necessary permissions.