CVE-2026-0787 is a critical remote code execution flaw in the ALGO 8180 IP Audio Alerter, caused by a missing check on a user-supplied string in the SAC module. NVD scores it 9.8 and no login is needed. ZDI published it as a 0-day, and no vendor fix is named, so isolate the device from untrusted networks.
What's affected
- Product: ALGO 8180 IP Audio Alerter and its firmware. The advisory does not list specific versions.
- Fixed version: none named. The ZDI advisory (ZDI-26-009) was published as a 0-day, and the vendor had not released a fix at the time. Check ALGO for anything newer.
- Severity: NVD records CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. ZDI lists its own score of 8.1 with attack complexity rated high. - Exploitation: it is not on the CISA KEV list. The advisories do not say it is exploited in the wild.
How to check if you're exposed
This is a network appliance, so there is no package to check. Find the devices first, then see who can reach them.
# On a management host, replace the range with your voice VLAN
nmap -sV -p 80,443,5060 10.20.30.0/24
Anything that identifies itself as an ALGO 8180 is in scope. Then ask which networks can send traffic to its SIP and web ports. If the answer includes the internet or a guest network, fix that first.
What to do now
- Put every ALGO 8180 on an isolated voice or paging VLAN and block it from the internet and from user networks.
- Allow SIP and the management page only from the call server or paging controller that needs them. ZDI says the only salient mitigation is to restrict interaction with the product.
- Contact ALGO support, quote the CVE and the ZDI number, and ask for a firmware date. Add a reminder to check again.
- Review the device logs and the network flow logs for unexpected SIP traffic from unfamiliar hosts.
- Record the exposure and the compensating control in your risk register until a patched firmware is installed.
Why it matters
The ZDI advisory describes the cause as the SAC module does not properly validate a user-supplied string before using it to execute a system call, and an attacker can run code in the context of the device. The weakness classes are CWE-78 (OS command injection).
This is one of five ALGO 8180 CVEs published together on 9 January 2026: CVE-2026-0787, CVE-2026-0791, CVE-2026-0792, CVE-2026-0793 and CVE-2026-0794. Reported by Claroty Research (Team82), the advisories describe separate flaws, so a fix for one does not imply a fix for the others.
Command injection is the plainer of the five: input reaches a system call, so the defence is to keep untrusted input away and to run nothing with that input. On a paging appliance that sits on a voice network, code execution can mean spying on or disrupting building announcements, so the effect is physical as well as digital.
Quick check
Is there a firmware fix for CVE-2026-0787?
No fixed version is named in the CVE record or the ZDI advisory. ZDI published it as a 0-day after the vendor was notified. Ask ALGO and isolate the device meanwhile.
Why does ZDI score it 8.1 when NVD says 9.8?
ZDI rates attack complexity as high, while the NVD record rates it low. Use the higher number to prioritise, since no authentication is needed either way.
Sources
Last reviewed: 19 October 2026.
