CVE-2026-0789 is a vulnerability categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) found in the ALGO 8180 IP Audio Alerter, specifically version 5.5. The vulnerability arises from the device's web-based user interface improperly including an authentication cookie within the HTTP response body. This flaw allows remote attackers to retrieve sensitive authentication tokens without requiring any authentication or user interaction, thereby exposing sensitive information that should remain confidential. The vulnerability is network exploitable (AV:N), requires low attack complexity (AC:L), and no privileges or user interaction (PR:N/UI:N) are needed, making it relatively easy to exploit. However, the impact is limited to confidentiality (C:L) without affecting integrity or availability. The vulnerability was identified and assigned by the Zero Day Initiative (ZDI) as ZDI-CAN-28297 and published on January 23, 2026. No patches or known exploits are currently available, but the exposure of authentication cookies could enable attackers to impersonate legitimate users or gain further access to device functions if combined with other vulnerabilities or misconfigurations.

For European organizations deploying ALGO 8180 IP Audio Alerter devices, this vulnerability poses a risk of unauthorized disclosure of sensitive authentication information. While it does not directly allow device control or denial of service, the exposure of authentication cookies can facilitate lateral movement, unauthorized access, or reconnaissance within the network. Organizations relying on these devices for critical audio alerting, such as in public safety, transportation hubs, or corporate environments, could face increased risk of targeted attacks if attackers leverage this information to escalate privileges or compromise device integrity indirectly. The lack of authentication requirement increases the attack surface, especially for devices accessible from less protected network segments. This could lead to breaches of confidentiality and potential compliance issues under European data protection regulations if sensitive information is exposed or misused.

Given the absence of an official patch at this time, European organizations should implement compensating controls to mitigate risk. These include restricting network access to the ALGO 8180 IP Audio Alerter web interface via firewall rules or network segmentation, ensuring the device is not exposed to untrusted networks or the internet. Employing strong network-level authentication and VPNs for remote access can reduce unauthorized exposure. Monitoring network traffic for unusual requests to the device's web interface may help detect exploitation attempts. Organizations should also engage with ALGO for timely updates or patches and plan for prompt deployment once available. Additionally, reviewing and hardening device configurations to minimize sensitive data exposure and disabling unnecessary web UI features can reduce attack vectors. Regular security assessments and penetration testing focused on these devices can identify residual risks.