CVE-2026-0794 is a critical remote code execution flaw in the ALGO 8180 IP Audio Alerter, caused by a use-after-free in the handling of SIP calls. NVD scores it 9.8 and no login is needed. ZDI published it as a 0-day, and no vendor fix is named, so isolate the device from untrusted networks.
What's affected
- Product: ALGO 8180 IP Audio Alerter and its firmware. The advisory does not list specific versions.
- Fixed version: none named. The ZDI advisory (ZDI-26-016) was published as a 0-day, and the vendor had not released a fix at the time. Check ALGO for anything newer.
- Severity: NVD records CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. ZDI lists its own score of 8.1 with attack complexity rated high. - Exploitation: it is not on the CISA KEV list. The advisories do not say it is exploited in the wild.
How to check if you're exposed
Find the devices, then see who can reach them.
nmap -sV -p 80,443,5060 10.20.30.0/24
Anything that identifies itself as an ALGO 8180 is in scope. Check which networks can reach its SIP and web ports.
What to do now
- Put every ALGO 8180 on an isolated voice or paging VLAN and block it from the internet and from user networks.
- Allow SIP and the management page only from the call server or paging controller that needs them. ZDI says the only salient mitigation is to restrict interaction with the product.
- Contact ALGO support, quote the CVE and the ZDI number, and ask for a firmware date. Add a reminder to check again.
- Record the exposure and the compensating control in your risk register until a patched firmware is installed.
Why it matters
The ZDI advisory describes the cause as the device does not validate that an object still exists before it performs operations on it while handling SIP calls, which lets an attacker run code in the context of the device. The weakness classes are CWE-416 (use after free).
This is one of five ALGO 8180 CVEs published together on 9 January 2026: CVE-2026-0787, CVE-2026-0791, CVE-2026-0792, CVE-2026-0793 and CVE-2026-0794. Reported by Claroty Research (Team82), the advisories describe separate flaws, so a fix for one does not imply a fix for the others.
Use-after-free is a lifetime bug rather than a length bug. The code keeps using memory after it was released, and what sits there can be changed by someone else. These bugs are hard for scanners to see, and they depend on timing, which is one reason ZDI rates the complexity of the attack as high.
Quick check
Is there a firmware fix for CVE-2026-0794?
No fixed version is named in the CVE record or the ZDI advisory. ZDI published it as a 0-day after the vendor was notified. Ask ALGO and isolate the device meanwhile.
Why is a use-after-free harder to rate than an overflow?
It depends on timing and memory layout. ZDI rates the attack complexity as high for this reason, while NVD records a lower complexity, so use the higher severity when prioritising.
Sources
Last reviewed: 19 October 2026.
