ALGO 8180 IP Audio Alerter devices are vulnerable to a command injection flaw in the API interface. The vulnerability arises because the device does not properly validate user‑supplied strings that are passed to a system call, allowing an attacker to execute arbitrary code in the context of the device. Because the flaw can be exploited remotely and only requires authentication, a compromised device can become a foothold for further lateral movement, data exfiltration, or denial of service against the network it services.

The affected product is the ALGO 8180 IP Audio Alerter. The vulnerability is present in firmware versions identified by the CPE as 5.5 and potentially earlier releases. All installations that expose the device’s API to authenticated users are at risk.

The CVSS base score of 8.8 indicates a high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at the current time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote, authenticated access to the API, making the attack vector likely local to the network segment that can reach the device’s management interface. If the API is exposed to the broader internet, the risk increases. The lack of input validation (CWE‑78) means that any authenticated request containing a crafted string can trigger a system call, leading to complete device compromise.