Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated) | Advisories

Advisories

Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)

severity: high
date: January 13, 2026
Affecting: Algo 8028 3.3.3
CVE: CVE-2022-50909
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-50960
Algo Solutions Official Homepage
Algo 8028 Firmware Downloads
Credit: Filip Carlsson
Description: Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.