CVE-2026-0793 is a critical remote code execution flaw in the ALGO 8180 IP Audio Alerter, caused by a heap buffer overflow in the InformaCast functionality. NVD scores it 9.8 and no login is needed. ZDI published it as a 0-day, and no vendor fix is named, so isolate the device from untrusted networks.
What's affected
- Product: ALGO 8180 IP Audio Alerter and its firmware. The advisory does not list specific versions.
- Fixed version: none named. The ZDI advisory (ZDI-26-015) was published as a 0-day, and the vendor had not released a fix at the time. Check ALGO for anything newer.
- Severity: NVD records CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. ZDI lists its own score of 8.1 with attack complexity rated high. - Exploitation: it is not on the CISA KEV list. The advisories do not say it is exploited in the wild.
How to check if you're exposed
Find the devices, then see who can reach them.
nmap -sV -p 80,443,5060 10.20.30.0/24
Anything that identifies itself as an ALGO 8180 is in scope. Check which networks can reach its SIP and web ports.
What to do now
- Put every ALGO 8180 on an isolated voice or paging VLAN and block it from the internet and from user networks.
- Allow SIP and the management page only from the call server or paging controller that needs them. ZDI says the only salient mitigation is to restrict interaction with the product.
- Contact ALGO support, quote the CVE and the ZDI number, and ask for a firmware date. Add a reminder to check again.
- Record the exposure and the compensating control in your risk register until a patched firmware is installed.
Why it matters
The ZDI advisory describes the cause as the InformaCast function copies user-supplied data into a heap buffer without validating its length, which lets an attacker run code in the context of the device. The weakness classes are CWE-122 (heap-based buffer overflow) and CWE-787 (out-of-bounds write).
This is one of five ALGO 8180 CVEs published together on 9 January 2026: CVE-2026-0787, CVE-2026-0791, CVE-2026-0792, CVE-2026-0793 and CVE-2026-0794. Reported by Claroty Research (Team82), the advisories describe separate flaws, so a fix for one does not imply a fix for the others.
InformaCast is an emergency notification feature, so if you use it, the device is likely wired into critical alerting. That raises the cost of both a compromise and of switching the device off, which is why isolating the network path beats unplugging it.
Quick check
Is there a firmware fix for CVE-2026-0793?
No fixed version is named in the CVE record or the ZDI advisory. ZDI published it as a 0-day after the vendor was notified. Ask ALGO and isolate the device meanwhile.
Does this matter if I do not use InformaCast?
The advisory places the flaw in the InformaCast functionality and does not say whether it can be switched off. Assume the device is exposed until ALGO says otherwise.
Sources
Last reviewed: 19 October 2026.
