A command injection flaw exists in the web‑based user interface of the ALGO 8180 IP Audio Alerter. Because the device does not validate a user‑supplied string before executing it as a system call, a logged‑in attacker can run arbitrary code with the privileges of the device. The vulnerability enables compromise of confidentiality, integrity, and availability of the entire device and any network services it provides. Authentication is required, so only accounts with valid credentials can exploit the flaw, but such credentials are typically available to administrators and other trusted users.

The affected product is the ALGO 8180 IP Audio Alerter. Firmware versions noted in the CPE entries include the 5.5 release of the device's firmware.

With a CVSS score of 8.8, the flaw is high severity. The EPSS score is reported as less than 1%, indicating that actual exploitation is currently unlikely, yet the vulnerability is still officially documented and not listed in the CISA KEV catalog. Exploitation requires authenticated access to the web UI, so the attack vector is likely internal or from a compromised credential. Once exploited, an attacker can achieve full device control and potentially spread further into the network.