The flaw is a command injection in the web‑based user interface that allows authenticated users to supply an arbitrary string, which the device passes directly to a system call. Successful exploitation gives the attacker the ability to run any command with the device’s privileges, compromising confidentiality, integrity, and availability. This weakness is a classic example of CWE‑78: Improper Neutralization of Special Elements used in a Command.

Affects the ALGO 8180 IP Audio Alerter device, specifically firmware version 5.5. No other affected versions are listed in the current data, so devices running this or earlier firmware are potentially vulnerable.

The CVSS score of 8.8 marks this as high severity, yet the EPSS score of under 1% indicates a very low expected exploitation probability at present. The vulnerability is not yet included in the CISA KEV catalog. The attack vector requires authentication, implying the attacker must first gain or possess valid credentials for the web UI. Once authenticated, the attacker can supply a crafted input that the device executes as a system command, leading to full code execution on the device.