This vulnerability in the ALGO 8180 IP Audio Alerter Web UI allows a remote attacker to inject and execute arbitrary operating system commands. The flaw arises from insufficient validation of user‑supplied strings before they are passed to a system call. Leveraging this weakness, a privileged attacker can run code with the same permissions as the device’s internal processes, potentially compromising confidentiality, integrity, and availability of the system and any connected resources.

The affected system is the ALGO 8180 IP Audio Alerter, specifically firmware version 5.5 and any earlier builds that contain the same web interface defect. Devices deployed with this firmware should be considered vulnerable.

The CVSS score of 8.8 classifies this flaw as high severity, while the EPSS score of less than 1% indicates a very low but nonzero likelihood of exploitation in the wild. The vulnerability requires authentication, meaning an attacker must first gain access to a user account or have network visibility to the management interface. No current listing in the CISA KEV catalog suggests no known active exploitation, yet the remote code execution potential warrants immediate attention.