Apcupsd
Monthly
Stack-based buffer overflow in apcupsd through 3.14.14 allows unauthenticated remote attackers to corrupt memory and potentially execute code through the optional CGI web interface. The flaw lives in getupsvar() in src/cgi/upsfetch.c, which is invoked by upsstats.cgi, multimon.cgi, and upsfstats.cgi; exploitation requires one of those CGI scripts to be deployed and reachable, plus the ability to control or man-in-the-middle the UPS variable data fed to it from an apcupsd Network Information Server. This is an AC:H, PR:N issue with full confidentiality, integrity, and availability impact; no public exploit code has been identified at time of analysis, and it is a related issue to CVE-2026-15544.
Uninitialized stack memory disclosure in apcupsd's optional CGI web interface (upsstats.cgi, multimon.cgi, upsfstats.cgi) allows remote attackers to read non-deterministic stack contents from HTTP responses when a matched STATUS line contains fewer than three whitespace-separated tokens. All versions through 3.14.14 are affected per the CPE range, but exposure requires that the non-default CGI component be built, deployed, and network-reachable; the core apcupsd daemon itself is not affected. The issue is rated low severity (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) both because the parsing condition is narrow and because the leaked bytes are uninitialized memory whose contents are unpredictable and frequently non-sensitive; no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV).
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Stack-based buffer overflow in apcupsd through 3.14.14 allows unauthenticated remote attackers to corrupt memory and potentially execute code through the optional CGI web interface. The flaw lives in getupsvar() in src/cgi/upsfetch.c, which is invoked by upsstats.cgi, multimon.cgi, and upsfstats.cgi; exploitation requires one of those CGI scripts to be deployed and reachable, plus the ability to control or man-in-the-middle the UPS variable data fed to it from an apcupsd Network Information Server. This is an AC:H, PR:N issue with full confidentiality, integrity, and availability impact; no public exploit code has been identified at time of analysis, and it is a related issue to CVE-2026-15544.
Uninitialized stack memory disclosure in apcupsd's optional CGI web interface (upsstats.cgi, multimon.cgi, upsfstats.cgi) allows remote attackers to read non-deterministic stack contents from HTTP responses when a matched STATUS line contains fewer than three whitespace-separated tokens. All versions through 3.14.14 are affected per the CPE range, but exposure requires that the non-default CGI component be built, deployed, and network-reachable; the core apcupsd daemon itself is not affected. The issue is rated low severity (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) both because the parsing condition is narrow and because the leaked bytes are uninitialized memory whose contents are unpredictable and frequently non-sensitive; no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV).
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitrary code with elevated privileges by. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.