Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50909Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
High 8.8
In plain English
A high-severity OS command injection in Algo 8028 from Algo Solutions. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.4%top 15.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Algo Solutions | Algo 8028 | 3.3.3 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50960 exploit
- Algo Solutions Official Homepage product
- Algo 8028 Firmware Downloads product
- VulnCheck Advisory: Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated) third-party-advisory