CVE-2026-0788 ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability

Medium 5.3 Published 23 Jan 2026 Updated 23 Jan 2026

Remote attackers can inject arbitrary scripts into the ALGO 8180 IP Audio Alerter web UI via the syslog viewer, allowing them to execute actions with target user privileges without authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-0788?

CVE-2026-0788 is a medium-severity cross-site scripting vulnerability in ALGO 8180 IP Audio Alerter, published on 23 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a target user's privileges on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the functionality for viewing the syslog. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to interact with the application in the context of the target user. Was ZDI-CAN-28298.

Weakness: CWE-79

Which versions are affected by CVE-2026-0788?

It affects 1 product.

Products include Algosolutions 8180 Ip Audio Alerter Firmware.

How do I fix CVE-2026-0788?

No fix has been published for CVE-2026-0788 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-0788 being exploited?

There is no known exploitation of CVE-2026-0788 in the wild and no public exploit code.

Sources

Also known as GHSA-xw4f-xqx2-q257.