CVE-2026-0792 is a critical remote code execution flaw in the ALGO 8180 IP Audio Alerter, caused by a stack buffer overflow in SIP Alert-Info header handling. NVD scores it 9.8 and no login is needed. ZDI published it as a 0-day, and no vendor fix is named, so isolate the device from untrusted networks.
What's affected
- Product: ALGO 8180 IP Audio Alerter and its firmware. The advisory does not list specific versions.
- Fixed version: none named. The ZDI advisory (ZDI-26-014) was published as a 0-day, and the vendor had not released a fix at the time. Check ALGO for anything newer.
- Severity: NVD records CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. ZDI lists its own score of 8.1 with attack complexity rated high. - Exploitation: it is not on the CISA KEV list. The advisories do not say it is exploited in the wild.
How to check if you're exposed
This is a network appliance, so there is no package to check. Find the devices first, then see who can reach them.
# On a management host, replace the range with your voice VLAN
nmap -sV -p 80,443,5060 10.20.30.0/24
Anything that identifies itself as an ALGO 8180 is in scope. Then ask which networks can send traffic to its SIP and web ports. If the answer includes the internet or a guest network, fix that first.
What to do now
- Put every ALGO 8180 on an isolated voice or paging VLAN and block it from the internet and from user networks.
- Allow SIP and the management page only from the call server or paging controller that needs them. ZDI says the only salient mitigation is to restrict interaction with the product.
- Contact ALGO support, quote the CVE and the ZDI number, and ask for a firmware date. Add a reminder to check again.
- Review the device logs and the network flow logs for unexpected SIP traffic from unfamiliar hosts.
- Record the exposure and the compensating control in your risk register until a patched firmware is installed.
Why it matters
The ZDI advisory describes the cause as the device handles the Alert-Info header of SIP INVITE requests without validating the length of user-supplied data before copying it into a fixed-length stack buffer, so an attacker can run code in the context of the device. The weakness classes are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write).
This is one of five ALGO 8180 CVEs published together on 9 January 2026: CVE-2026-0787, CVE-2026-0791, CVE-2026-0792, CVE-2026-0793 and CVE-2026-0794. Reported by Claroty Research (Team82), the advisories describe separate flaws, so a fix for one does not imply a fix for the others.
Alert-Info is a header that tells a phone which ring or alert tone to play, which is just the sort of field an audio alerter reads closely. Devices built to react to call signals have to parse them, and parsing untrusted headers with fixed buffers is a well-known source of memory bugs. Keep the SIP path closed to everyone except your call server.
Quick check
Is there a firmware fix for CVE-2026-0792?
No fixed version is named in the CVE record or the ZDI advisory. ZDI published it as a 0-day after the vendor was notified. Ask ALGO and isolate the device meanwhile.
How is this different from CVE-2026-0791?
Both are stack overflows in SIP INVITE handling, but in different headers: Alert-Info here and Replaces there. They are separate flaws, so check each.
Sources
Last reviewed: 19 October 2026.
