CVE-2026-54161
Received Received - Intake

Command Injection in Network UPS Tools

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-54161
EUVD
EUVD-2026-116198

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
networkupstools nut >= 2.8.3, <= 2.8.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54161 is a remote code execution (RCE) flaw in Network UPS Tools (NUT) upsmon component. When a monitored UPS reports an ALARM state and NOTIFYCMD is configured with EXEC for ALARM events, upsmon unsafely inserts the server-supplied ups.alarm value into shell commands. Attackers can inject malicious shell metacharacters (e.g., $(command) or backticks) to execute arbitrary OS commands as the upsmon user, often root. Exploitation requires NOTIFYCMD EXEC configuration but can occur via malicious UPS devices, compromised upsd servers, or man-in-the-middle attacks on plaintext connections.

The vulnerability affects NUT versions 2.8.3 to 2.8.5. It was fixed in 2.8.6 by replacing unsafe system() calls with direct execvp()/_spawnvp() execution, preventing shell interpretation of ups.alarm values.

Detection Guidance

Check if your NUT version is between 2.8.3 and 2.8.5 by running 'upsd -v' or 'upsmon -v'. Inspect upsmon.conf for NOTIFYCMD with EXEC enabled for ALARM events. Monitor network traffic for plaintext communication between upsd and upsmon on port 3493.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary commands on the system running upsmon with the privileges of the upsmon user, which is often root. This could lead to full system compromise, data theft, unauthorized access, or disruption of UPS monitoring services. Attackers could install malware, modify system configurations, or pivot to other systems in the network.

Compliance Impact

This vulnerability could lead to violations of GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data or systems. GDPR requires protecting personal data; a breach could result in fines. HIPAA mandates securing protected health information; exploitation could lead to compliance failures and penalties. Organizations must patch systems to maintain compliance.

Mitigation Strategies

Upgrade NUT to version 2.8.6 or later immediately. If upgrading is not possible, disable NOTIFYCMD EXEC for ALARM events in upsmon.conf or sanitize ups.alarm values. Ensure TLS is used between upsd and upsmon to prevent man-in-the-middle attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...