CVE-2022-50909 Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
Authenticated attackers can execute arbitrary commands with root privileges via the fm-data.lua endpoint in the Algo 8028 Control Panel.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-50909?
CVE-2022-50909 is a high-severity command injection vulnerability in Algo 8028, published on 13 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.
Weakness: CWE-78
Which versions are affected by CVE-2022-50909?
How do I fix CVE-2022-50909?
No fix has been published for CVE-2022-50909 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-50909 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-50909 exists.
Sources
Also known as GHSA-qmvp-687p-x9fw.