CVE-2022-50909
Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)
- State
- Published
- Severity
- 8.6 High
- Published
- Jan 13, 2026
- Updated
- Jan 14, 2026
- Reserved
- Jan 11, 2026
Description
Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Algo 8028Algo Solutions |
|
References
- ExploitDB-50960exploit
- Algo Solutions Official Homepageproduct
- Algo 8028 Firmware Downloadsproduct
- VulnCheck Advisory: Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.