ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability

A stack-based buffer overflow vulnerability has been identified in the ALGO 8180 IP Audio Alerter, allowing remote code execution. This issue arises from improper validation of the Replaces header in SIP INVITE requests, which enables attackers to exploit the vulnerability without authentication. The flaw exists because user-supplied data can be copied to a fixed-length buffer on the stack without adequate length checks, creating an opportunity for arbitrary code execution in the context of the affected device.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.

Remediation

The recommended mitigation strategy is to restrict interaction with the affected product.