This vulnerability allows remote attackers to obtain sensitive device data without authentication by directly requesting a URL in the web-based user interface. Based on the description, the flaw involves an improper restriction of network access that may expose configuration details and other device state information. Because the attacker does not need to authenticate, any network‑accessible HTTP request can trigger the disclosure, compromising the confidentiality of the device’s internal data.

Affected are ALGO 8180 IP Audio Alerter hardware devices, specifically models running the 5.5 firmware or earlier. The vulnerability is present in the web UI component of the product and applies to installations that expose this interface to the network.

The CVSS score of 7.5 indicates a high severity, but the EPSS score under 1% suggests that exploitation is unlikely in the current threat landscape. The device is not listed in the CISA KEV catalog, so there is no evidence of active exploitation. Attackers would need remote network connectivity to the device’s web interface and would not require administrative credentials. The exploit path would involve sending a crafted GET request to a specific URL; a successful request results in information disclosure.