A stack-based buffer overflow exists in the processing of the Alert-Info header of SIP INVITE requests for ALGO 8180 IP Audio Alerter devices. The flaw is caused by a lack of validation on the length of user supplied data before copying it into a fixed‑length stack buffer, allowing a crafted message to overwrite execution control data. Because no authentication is required, a remote attacker can send an arbitrary SIP INVITE over the network and cause the device to execute attacker supplied code in the context of the device’s firmware.

ALGO Solutions’ 8180 IP Audio Alerter devices, firmware version 5.5 and earlier, are impacted. The advisory does not provide more granular version details beyond the information that devices running firmware 5.5 and prior are vulnerable.

The vulnerability carries a CVSS score of 9.8, indicating a critical impact. The EPSS score is less than 1 %, suggesting a low current exploitation probability, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation is possible remotely through network traffic by sending a crafted SIP INVITE message with a malicious Alert‑Info header; authentication is not required, making the attack vector open to any device accessible over the network.