TL;DR

A critical remote command execution vulnerability in the web UI of ALGO 8180 IP Audio Alerter devices requires immediate attention from network administrators and operators.

What happened

['ALGO 8180 IP Audio Alerters have a severe RCE vulnerability allowing attackers to inject commands via the web UI with proper credentials.']

Why it matters for ops

['Remote code execution can lead to full system compromise, data exfiltration, or system-wide damage. Immediate patching is essential for security and compliance.']

Mitigation

  • Apply vendor-provided updates for ALGO 8180 devices
  • Monitor and restrict access to the affected IP ranges and services

Action items

  • Update all ALGO 8180 devices immediately upon availability of patches
  • Conduct an inventory check for any unpatched devices in your environment

Detection IOCs

  • HTTP requests targeting ALGO 8180 web UI with command injection attempts
  • Unexpected behavior or crashes following authentication-based actions in the ALGO 8180 UI

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-002/