Vendor
Network UPS Tools (NUT) versions 2.8.3 through 2.8.5 contain a remote OS command injection vulnerability in upsmon that allows arbitrary command execution via unsanitized ups.alarm values.