CVE-2022-50909

Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)

CVSS 8.6 HIGHEPSS 2.1%CWE-78

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.6EPSS 2.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

13 jan 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

Algo Solutions · Algo 8028

Referências

https://www.algosolutions.com/https://www.algosolutions.com/firmware-downloads/8028-firmware-selection/https://www.exploit-db.com/exploits/50960 https://www.vulncheck.com/advisories/algo-control-panel-remote-code-execution-rce-authenticated