A critical command injection vulnerability in the Algo 8028 Control Panel allows authenticated attackers to achieve remote code execution with root-level privileges.

This flaw involves improper input sanitization within the fm-data.lua endpoint, specifically targeting the source parameter. An authenticated attacker can inject malicious OS commands that the system executes with root privileges via a crafted POST request.

Successful exploitation grants an attacker full control over the affected device, potentially leading to total system compromise, unauthorized data access, and the ability to use the device as a pivot point for further attacks on the internal network. Given the CVSS score of 8.8, this vulnerability represents a high-risk scenario that could lead to significant operational disruption and loss of confidentiality, integrity, and availability.

Immediate Action: Update the Algo 8028 Control Panel to the latest firmware version provided by the manufacturer to patch the command injection flaw.

Proactive Monitoring: Review system access logs for anomalous POST requests directed at the fm-data.lua endpoint, particularly those containing shell metacharacters.

Compensating Controls: If an immediate update is not possible, restrict access to the control panel interface to authorized administrative IP addresses only and ensure the device is segmented behind a firewall.

Public Exploit Available: Yes, a functional exploit script is available via ExploitDB (EDB-ID: 50960).

The severity of this vulnerability, combined with the availability of a public exploit, necessitates immediate action. Administrators should prioritize upgrading the affected firmware to eliminate the command injection vector and prevent unauthorized root access to their infrastructure.