The vulnerability is a command injection flaw in the web‑based user interface of the ALGO 8180 IP Audio Alerter. Improper validation of a user‑supplied string allows an attacker to execute arbitrary system commands in the context of the device, resulting in full device compromise. This aligns with CWE‑78, which describes the misuse of operating system facilities to execute unintended operations.

Known affected devices are ALGO 8180 IP Audio Alerter units, particularly firmware version 5.5. The product is identified by the manufacturer ALGO Solutions. Any installation of this hardware that exposes the web UI and relies on the vulnerable firmware is at risk.

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score indicates a very low probability of exploitation (<1%), which reflects limited observed activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the web UI and valid authenticated credentials, suggesting that attackers with legitimate credentials or those who can bypass authentication can leverage the flaw.