A command injection flaw in the web‐based management console of the ALGO 8180 IP Audio Alerter allows an authenticated user to insert unsanitized input into a system call. The vulnerability is classified as CWE‑77 and CWE‑78. Exploitation enables the attacker to run arbitrary commands with the privileges of the device, potentially compromising confidentiality, integrity, and availability of the audio alerting platform.

All installations of ALGO Solutions’ 8180 IP Audio Alerter, including firmware 5.5 and later versions that contain the vulnerable web interface, are affected. Any device that hosts the management console can be targeted.

The CVSS score of 8.8 indicates high severity. However, the EPSS score of less than 1% shows a very low probability of exploitation at present. Because the flaw requires authentication to access the vulnerable interface, an attacker must first compromise credentials or gain legitimate login access. The device runs commands in its own context, which provides full control over the radio hardware and software stack. Although exploitation is unlikely to be widespread, the impact of a successful attack is catastrophic, and the vulnerability is not yet listed in the CISA KEV catalog.