A critical stack-based buffer overflow in ALGO 8180 IP Audio Alerter devices allows unauthenticated remote attackers to execute arbitrary code, posing a severe risk to device integrity.

The vulnerability exists due to improper length validation of the Alert-Info header within SIP INVITE requests before copying data to a fixed-length stack buffer. This flaw can be triggered by an unauthenticated attacker, allowing for remote code execution in the context of the affected device.

Successful exploitation of this vulnerability permits unauthorized remote code execution, which could lead to full system compromise, loss of confidentiality, and disruption of critical audio alerting services. Given the CVSS score of 8.1, the high potential for impact on device availability and data integrity necessitates immediate attention, especially for units deployed in sensitive or public-facing network segments.

Immediate Action: Update affected ALGO 8180 IP Audio Alerter devices to the latest firmware version as specified in the vendor advisory.

Proactive Monitoring: Monitor network traffic for malformed or unusually large SIP INVITE requests directed at the audio alerter, and review system logs for signs of unexpected process execution.

Compensating Controls: Restrict access to SIP signaling ports (typically UDP 5060) via firewall rules to allow traffic only from trusted VoIP controllers or internal management segments.

Public Exploit Available: No (There is no confirmed public exploit or weaponized module currently available).

The severity of this vulnerability, combined with its ability to be exploited without authentication, makes it a high-priority item for remediation. Administrators must identify all instances of the ALGO 8180 IP Audio Alerter within their environment and apply the necessary firmware updates immediately to prevent unauthorized remote access and potential system takeover.