CVE-2026-0790VulnerabilityPublished 23 Jan 2026

CVE-2026-0790: ALGO 8180 IP Audio Alerter · Forced Browsing

Affects ALGO 8180 IP Audio AlerterSource CVE Database V5

Not known to be exploited · CVSS 5.3 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.0 base score

5.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.7% chance of exploitation in 30 days – higher than 54% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
ALGO8180 IP Audio Alerter	Affected =5.5	Fixed in–

AI-suggested

Since no official patches or updates are currently available for ALGO 8180 IP Audio Alerter version 5.5, European organizations should implement compensating controls to mitigate the risk. These include restricting network access to the device's management interface by placing it behind firewalls or VPNs, limiting access to trusted administrative networks only. Employ network segmentation to isolate the device from general user networks and the internet. Enable and monitor logging on the device and network perimeter to detect unusual direct URL access attempts indicative of forced browsing. Conduct regular vulnerability scans and penetration tests focusing on web UI endpoints to identify unauthorized access paths. Engage with ALGO support for any available firmware updates or workarounds. Additionally, consider deploying web application firewalls (WAFs) with rules to block suspicious URL patterns targeting the device. Finally, maintain an inventory of all ALGO 8180 devices in use and ensure that security policies reflect the need for strict access controls on these assets.

Description

CVE-2026-0790 is a medium severity vulnerability in the ALGO 8180 IP Audio Alerter device that allows unauthenticated remote attackers to disclose sensitive information via direct URL requests to the device's web UI. The flaw, categorized as CWE-425 (Direct Request or Forced Browsing), enables attackers to bypass authentication by directly accessing specific URLs, exposing data without user interaction. While no known exploits are currently active in the wild, the vulnerability affects version 5.5 of the product and poses confidentiality risks. Exploitation requires no privileges or user interaction, but does not impact integrity or availability. European organizations using ALGO 8180 devices, particularly in sectors relying on IP audio alerting, should prioritize mitigation. No official patches are currently available, so network-level controls and monitoring are essential to reduce exposure.

Impact

For European organizations, the primary impact of CVE-2026-0790 is the unauthorized disclosure of sensitive information from ALGO 8180 IP Audio Alerter devices. This could include configuration details, network information, or operational data that attackers could leverage for further intrusion or disruption. While the vulnerability does not directly compromise system integrity or availability, the confidentiality breach could facilitate lateral movement or targeted attacks within critical infrastructure environments. Organizations in sectors such as public safety, transportation, or facilities management that deploy these devices for alerting purposes may face increased risk of espionage or operational disruption. The lack of authentication requirement lowers the barrier for attackers, increasing the likelihood of opportunistic scanning and exploitation attempts. Given the absence of known exploits in the wild, the immediate risk is moderate, but the exposure of sensitive data could have cascading effects on security posture and incident response.

Summary

CVE-2026-0790 identifies a security weakness in the ALGO 8180 IP Audio Alerter, specifically within its web-based user interface. The vulnerability is classified under CWE-425, which involves direct request or forced browsing attacks. In this case, an attacker can craft a direct URL request to the device's web UI endpoints to access sensitive information without needing to authenticate. This bypass occurs because the application fails to properly enforce access controls on certain resources, allowing unauthorized disclosure of data. The vulnerability affects version 5.5 of the ALGO 8180 IP Audio Alerter and was publicly disclosed on January 23, 2026. The CVSS v3.0 base score is 5.3 (medium severity), reflecting that the attack vector is network-based, requires no privileges, no user interaction, and impacts confidentiality only, without affecting integrity or availability. No patches or fixes have been published yet, and no active exploits have been reported in the wild. The vulnerability was assigned by the Zero Day Initiative (ZDI) under the identifier ZDI-CAN-28299. The nature of the device—used for IP audio alerting—means that sensitive operational or configuration data could be exposed, potentially aiding further attacks or reconnaissance.

CWE-425Direct Request ('Forced Browsing') (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Architecture and Design · Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
Architecture and Design
Consider using MVC based frameworks such as Struts.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V1.2.3 (opens in a new tab)
V1.2.2 (opens in a new tab)
Attack patterns
Directory Indexing (opens in a new tab)
Detect Unpublicized Web Pages (opens in a new tab)
Detect Unpublicized Web Services (opens in a new tab)
Key Negotiation of Bluetooth Attack (KNOB) (opens in a new tab)
Forceful Browsing (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

zerodayinitiative.com/advisories/ZDI-26-012/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Jan 2026, 10:07 UTC

WeaknessesCWE-425

Technical details

References

Community reviews

Related threats