Skip to main content

NUT upsmon CVE-2026-54161

CRITICAL
2026-07-01
Command Injection Microsoft Suse
Share

Severity by source

vuln.today AI
9.0 CRITICAL

AV:N for 3493/tcp network path; AC:H requires MitM or upsd compromise; PR:N needs no target auth; S:C since payload escapes upsmon process scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

1
Analysis Generated
Jul 01, 2026 - 20:21 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Remote OS command injection in Network UPS Tools upsmon (versions 2.8.3-2.8.5) allows a network-positioned attacker - acting as a man-in-the-middle on the plaintext 3493/tcp NUT protocol connection, operating a compromised upsd server, or controlling a rogue UPS device - to execute arbitrary shell commands as the upsmon service account. The vulnerability exists in the NOTIFYCMD alarm handler, where server-supplied ups.alarm text is interpolated directly into a shell command string and executed via system(), enabling injection of shell metacharacters. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the oss-security disclosure contains sufficient implementation detail to construct a working exploit.

Technical ContextAI

Network UPS Tools (NUT) is an open-source UPS monitoring suite; its upsmon daemon connects to an upsd server over TCP port 3493, receives UPS status events, and optionally executes administrator-defined notification commands when events such as ALARM occur. The root cause is CWE-78 (Improper Neutralization of Special Elements Used in an OS Command), present in the notify(), async_notify(), and wall() functions. In each, upsmon constructs a command string via snprintf() by directly interpolating the server-supplied ups.alarm value - controlled by upsd or the UPS device itself - then passes the resulting string to system(), which invokes the system shell. Any shell metacharacters (semicolons, backticks, pipes, $() subshells) embedded in ups.alarm are therefore interpreted as shell syntax rather than treated as literal argument text. On POSIX systems, upsmon forks and drops privileges to the unprivileged nut/ups service account before executing notifications, which bounds the blast radius; on Windows, no privilege drop occurs, meaning injected commands inherit the full process token. The flaw was introduced between 2.8.2 and 2.8.3; no formal NVD CPE strings are published yet, but affected versions are explicitly identified by the reporter as 2.8.3, 2.8.4, and 2.8.5.

Affected ProductsAI

Network UPS Tools (NUT) versions 2.8.3, 2.8.4, and 2.8.5 are confirmed affected, along with pre-fix git master. Version 2.8.2 and all earlier releases are explicitly stated as not affected. The vulnerability is isolated to the upsmon component and its NOTIFYCMD handling code. No formal CPE strings have been published at time of analysis. The upstream fix is tracked in GitHub pull request #3499 at https://github.com/networkupstools/nut/pull/3499, and the security advisory is published at https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5. Distribution packages shipping NUT 2.8.3 through 2.8.5 are advised by the reporter to backport the fix.

RemediationAI

The upstream fix is available as GitHub PR #3499 (https://github.com/networkupstools/nut/pull/3499), which eliminates the vulnerable system() call by replacing it with execvp() on POSIX and _spawnvp() on Windows, passing the NOTIFYCMD and alarm text as an argv array so shell interpretation never occurs. A tagged stable release incorporating this fix has not been independently confirmed at time of analysis; operators should monitor the GitHub advisory at https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5 for a patched release and apply distribution-provided backports when available. As an immediate compensating control with no patch available, administrators should remove the EXEC flag from NOTIFYFLAG ALARM directives in upsmon.conf - this disables external command execution on alarm events entirely, closing the vulnerable code path, at the cost of losing script-based alarm automation. A second compensating control is to restrict the 3493/tcp NUT protocol port with firewall rules so that upsmon only connects to known-trusted upsd hosts, eliminating the MitM attack vector; this does not address the compromised-upsd or rogue-UPS scenarios. If NUT's SSL/TLS support is available in the deployed version, enabling it for the upsd connection defeats plaintext interception.

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

Share

CVE-2026-54161 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy