The flaw allows a remote attacker to inject an operating system command through the SCI module, enabling execution of arbitrary code on the device. The vulnerability arises because user‑supplied strings are passed directly to a system call without validation. Because the attacker must authenticate, the exposure is limited to users with valid credentials, but the resulting code execution grants the attacker the same privileges as the device process.

ALGO Solutions’ 8180 IP Audio Alerter devices, including firmware version 5.5, are affected by the command injection flaw.

With a CVSS score of 8.8, the vulnerability is deemed high severity. The EPSS score of <1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over the network because authentication is required to send the malicious command. Attackers would need valid device credentials to trigger the flaw, but once authenticated they could control the device’s operating system and potentially elevate their damage.