Network UPS Tools - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/network-ups-tools/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 21:27:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNetwork UPS Tools: OS command injection in upsmon (CVE-2026-54161)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-54161/Tue, 03 Nov 2026 21:27:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-54161/Network UPS Tools (NUT) versions 2.8.3 through 2.8.5 contain a remote OS command injection vulnerability in upsmon that allows arbitrary command execution via unsanitized ups.alarm values.Network UPS Tools (NUT) versions 2.8.3 through 2.8.5 are vulnerable to OS command injection within the upsmon component. The flaw exists in the way the notify(), async_notify(), and wall() functions handle the 'ups.alarm' value supplied by the UPS server. If an operator has configured 'NOTIFYCMD' with the 'EXEC' flag for 'NOTIFYFLAG ALARM', the application concatenates the server-supplied alarm text into a shell command.

An attacker who can control the UPS device or compromise the upsd service, or perform a man-in-the-middle attack on a plaintext connection between upsd and upsmon, can inject shell metacharacters into the alarm value. This results in code execution with the privileges of the upsmon process, which is often configured as root. This vulnerability is fixed in version 2.8.6.

Impact

Successful exploitation allows for arbitrary operating-system command execution with the privileges of the upsmon process (commonly root). This provides an attacker with the ability to fully compromise the host system running the NUT client.

Recommendation

  • Upgrade Network UPS Tools to version 2.8.6 or later on all installations.
  • Review upsmon configurations to identify instances where 'NOTIFYCMD' is utilized with the 'EXEC' flag for 'NOTIFYFLAG ALARM'.
  • Ensure that connections between upsd and upsmon are encrypted using TLS to mitigate potential man-in-the-middle attacks, noting that this does not mitigate risks from an already compromised UPS device.
]]>highadvisory