Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-50909: Algo 8028 Control Panel allows attackers to execute arbitrary commands

CVE-2022-50909 · published 9 months ago

Summary

An attacker with an account on the Algo 8028 Control Panel can send a malicious request to execute commands with root access. This could allow the attacker to make changes to the system or steal sensitive information. Update to the latest version of the control panel to fix this issue.

Original advisory text

Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.

References

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.6 High

Exploitation

2% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published13 Jan 2026

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2022-50909 · NVD

Track software like this

Free during beta