This vulnerability is an OS command injection flaw in the web‑based user interface of ALGO 8180 IP Audio Alerter devices. The flaw arises because the system fails to validate a user‑supplied string before passing it to a system call. Remote attackers who can authenticate to the web UI can send crafted input that results in arbitrary code execution in the device’s process context.

Affected systems are ALGO 8180 IP Audio Alerter devices running firmware version 5.5, as indicated by the vendor’s CPE data. All installations of this hardware that provide a web UI with authentication are vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability appears in the web interface, so an attacker must first obtain valid credentials; once logged in, they can inject commands remotely. The flaw is not listed in CISA’s KEV catalog, indicating no publicly known exploits to date. Nonetheless, the risk remains significant due to the potential for device compromise and the ability to bypass the device’s security controls.