CVE-2022-50909

Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)

CVSS 8.6 HIGHEPSS 2.1%CWE-78

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.6EPSS 2.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

13 ene 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Algo Solutions · Algo 8028

Referencias

https://www.algosolutions.com/https://www.algosolutions.com/firmware-downloads/8028-firmware-selection/https://www.exploit-db.com/exploits/50960 https://www.vulncheck.com/advisories/algo-control-panel-remote-code-execution-rce-authenticated