apcupsd EUVD-2026-90027

Exploitation requires that one of the affected CGI scripts (upsstats.cgi, multimon.cgi, or upsfstats.cgi) is actually deployed and reachable on a web server - these are optional components not enabled in a default daemon-only apcupsd install. The attacker must also be able to influence the UPS variable data returned to getupsvar(), i.e. control a malicious apcupsd Network Information Server or man-in-the-middle the NIS traffic feeding the CGI; this is the AC:H limiting factor. Affected versions are apcupsd through 3.14.14. No user interaction or authentication is required (PR:N/UI:N), but the optional web front-end plus the data-control requirement substantially narrow the realistic attack surface versus the raw 8.1 score.

The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated, network-reachable stack-based buffer overflow with full CIA impact, consistent with potential remote code execution from an sscanf overflow in a CGI-invoked C function. However, the AC:H (high attack complexity) metric is the key tempering signal: exploitation is not a simple one-shot request but depends on the attacker controlling the UPS/NIS data that getupsvar() parses, plus reliable stack-overflow exploitation of a %s-into-fixed-buffer sscanf pattern. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so there is no evidence of active exploitation or automatable mass-exploitation - this reads as a real but conditional priority (unauth RCE potential in a network daemon's web front-end) rather than an urgent in-the-wild threat. There is no SSVC decision data supplied. One data caveat: AV:N is asserted, but the realistic path requires either a malicious/compromised apcupsd Network Information Server or a man-in-the-middle influencing data returned to the CGI - verify the actual data-flow with the vendor/patch commit before treating it as trivially remote.

An attacker who can control or spoof the apcupsd Network Information Server (NIS) data consumed by a web-exposed monitoring CGI (upsstats.cgi, multimon.cgi, or upsfstats.cgi) returns an over-long UPS variable value; when getupsvar() parses it with an unbounded sscanf into a fixed stack buffer, the return address is overwritten. Successful exploitation can lead to code execution in the context of the web/CGI process. No public exploit code is identified at time of analysis, though the vulnerable source line is publicly referenced on GitHub and the flaw is a known variant of CVE-2026-15544.