{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/network-ups-tools/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:network_ups_tools:network_ups_tools:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-54161"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Network UPS Tools (2.8.3-2.8.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Network UPS Tools"],"content_html":"\u003cp\u003eNetwork UPS Tools (NUT) versions 2.8.3 through 2.8.5 are vulnerable to OS command injection within the upsmon component. The flaw exists in the way the notify(), async_notify(), and wall() functions handle the 'ups.alarm' value supplied by the UPS server. If an operator has configured 'NOTIFYCMD' with the 'EXEC' flag for 'NOTIFYFLAG ALARM', the application concatenates the server-supplied alarm text into a shell command.\u003c/p\u003e\n\u003cp\u003eAn attacker who can control the UPS device or compromise the upsd service, or perform a man-in-the-middle attack on a plaintext connection between upsd and upsmon, can inject shell metacharacters into the alarm value. This results in code execution with the privileges of the upsmon process, which is often configured as root. This vulnerability is fixed in version 2.8.6.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary operating-system command execution with the privileges of the upsmon process (commonly root). This provides an attacker with the ability to fully compromise the host system running the NUT client.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Network UPS Tools to version 2.8.6 or later on all installations.\u003c/li\u003e\n\u003cli\u003eReview upsmon configurations to identify instances where 'NOTIFYCMD' is utilized with the 'EXEC' flag for 'NOTIFYFLAG ALARM'.\u003c/li\u003e\n\u003cli\u003eEnsure that connections between upsd and upsmon are encrypted using TLS to mitigate potential man-in-the-middle attacks, noting that this does not mitigate risks from an already compromised UPS device.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T21:27:03Z","date_published":"2026-11-03T21:27:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-54161/","summary":"Network UPS Tools (NUT) versions 2.8.3 through 2.8.5 contain a remote OS command injection vulnerability in upsmon that allows arbitrary command execution via unsanitized ups.alarm values.","title":"Network UPS Tools: OS command injection in upsmon (CVE-2026-54161)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-54161/"}],"language":"en","title":"CraftedSignal Threat Feed - Network UPS Tools","version":"https://jsonfeed.org/version/1.1"}