CVE-2026-0791 is a critical remote code execution flaw in the ALGO 8180 IP Audio Alerter, caused by a stack buffer overflow in SIP INVITE handling. NVD scores it 9.8 and no login is needed. ZDI published it as a 0-day, and no vendor fix is named, so isolate the device from untrusted networks.
What's affected
- Product: ALGO 8180 IP Audio Alerter and its firmware. The advisory does not list specific versions.
- Fixed version: none named. The ZDI advisory (ZDI-26-013) was published as a 0-day, and the vendor had not released a fix at the time. Check ALGO for anything newer.
- Severity: NVD records CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. ZDI lists its own score of 8.1 with attack complexity rated high. - Exploitation: it is not on the CISA KEV list. The advisories do not say it is exploited in the wild.
How to check if you're exposed
This is a network appliance, so there is no package to check. Find the devices first, then see who can reach them.
# On a management host, replace the range with your voice VLAN
nmap -sV -p 80,443,5060 10.20.30.0/24
Anything that identifies itself as an ALGO 8180 is in scope. Then ask which networks can send traffic to its SIP and web ports. If the answer includes the internet or a guest network, fix that first.
What to do now
- Put every ALGO 8180 on an isolated voice or paging VLAN and block it from the internet and from user networks.
- Allow SIP and the management page only from the call server or paging controller that needs them. ZDI says the only salient mitigation is to restrict interaction with the product.
- Contact ALGO support, quote the CVE and the ZDI number, and ask for a firmware date. Add a reminder to check again.
- Review the device logs and the network flow logs for unexpected SIP traffic from unfamiliar hosts.
- Record the exposure and the compensating control in your risk register until a patched firmware is installed.
Why it matters
The ZDI advisory describes the cause as the device handles the Replaces header of SIP INVITE requests without validating the length of user-supplied data before copying it into a fixed-length stack buffer, which lets an attacker run code in the context of the device. The weakness classes are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write).
This is one of five ALGO 8180 CVEs published together on 9 January 2026: CVE-2026-0787, CVE-2026-0791, CVE-2026-0792, CVE-2026-0793 and CVE-2026-0794. Reported by Claroty Research (Team82), the advisories describe separate flaws, so a fix for one does not imply a fix for the others.
The SIP stack is the part of a phone device that talks to everyone, so it is the part that most needs a network boundary. Any host that can send a SIP INVITE to the device can reach this code, which is why the advice focuses on who is allowed to send it traffic.
Quick check
Is there a firmware fix for CVE-2026-0791?
No fixed version is named in the CVE record or the ZDI advisory. ZDI published it as a 0-day after the vendor was notified. Ask ALGO and isolate the device meanwhile.
Which SIP header is involved?
The Replaces header of SIP INVITE requests, per ZDI. The Alert-Info header is a separate flaw, CVE-2026-0792.
Sources
Last reviewed: 19 October 2026.
