The flaw is a use-after-free error in the SIP processing logic of the ALGO 8180 IP Audio Alerter. An attacker can send a crafted SIP message that triggers the deletion and subsequent re-use of an object that no longer exists, allowing execution of arbitrary code in the device’s context. No authentication is required, so the attack can be launched from any network that can reach the device. The resulting Remote Code Execution compromises the confidentiality, integrity and availability of the device and the network segment it serves.

The vulnerability affects ALGO Solutions’ 8180 IP Audio Alerter hardware, specifically firmware version 5.5 and any earlier releases that contain the referenced SIP handler. The device’s SIP interface is the attack surface.

The CVSS v3.1 score is 9.8, indicating a critical vulnerability, and the EPSS score of 1% suggests a low but non-zero current exploit probability. It is not yet included in CISA’s KEV catalog. The lack of authentication requirements and the dependency on interface traffic make remote exploitation feasible from outside the protected network. Attackers could gain full control of the device, potentially facilitating broader network compromise or denial of service.