CVE-2022-50909

Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated)

High8.6Public exploitEPSS 2.4%

Published: 13 Jan 2026
Updated: 14 Jan 2026
Reserved: 11 Jan 2026
Assigned by: VulnCheck

Description

Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-50960 (opens in a new tab)exploit

Timeline

2026
11 Jan 2026
11 Jan 2026
ID reserved
By VulnCheck
13 Jan 20262 days later
13 Jan 2026· 2 days later
Published
14 Jan 20261 day later
14 Jan 2026· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-50909, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 2.4% · top 16% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Algo Solutions · Algo 8028
- affected 3.3.3

References (4)

ExploitDB-50960 (opens in a new tab)exploit
Algo Solutions Official Homepage (opens in a new tab)product
Algo 8028 Firmware Downloads (opens in a new tab)product
VulnCheck Advisory: Algo 8028 Control Panel - Remote Code Execution (RCE) (Authenticated) (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-50909](https://trackcve.app/badge/CVE-2022-50909.svg)](https://trackcve.app/cve/CVE-2022-50909)

Record last updated 14 Jan 2026, 16:28 UTC.