Network UPS Tools: OS command injection in upsmon (CVE-2026-54161)

Network UPS Tools (NUT) versions 2.8.3 through 2.8.5 are vulnerable to OS command injection within the upsmon component. The flaw exists in the way the notify(), async_notify(), and wall() functions handle the 'ups.alarm' value supplied by the UPS server. If an operator has configured 'NOTIFYCMD' with the 'EXEC' flag for 'NOTIFYFLAG ALARM', the application concatenates the server-supplied alarm text into a shell command.

An attacker who can control the UPS device or compromise the upsd service, or perform a man-in-the-middle attack on a plaintext connection between upsd and upsmon, can inject shell metacharacters into the alarm value. This results in code execution with the privileges of the upsmon process, which is often configured as root. This vulnerability is fixed in version 2.8.6.

Impact

Successful exploitation allows for arbitrary operating-system command execution with the privileges of the upsmon process (commonly root). This provides an attacker with the ability to fully compromise the host system running the NUT client.

Recommendation

• Upgrade Network UPS Tools to version 2.8.6 or later on all installations.
• Review upsmon configurations to identify instances where 'NOTIFYCMD' is utilized with the 'EXEC' flag for 'NOTIFYFLAG ALARM'.
• Ensure that connections between upsd and upsmon are encrypted using TLS to mitigate potential man-in-the-middle attacks, noting that this does not mitigate risks from an already compromised UPS device.