CVE-2026-54161

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54161", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T21:46:52.380Z", "datePublished": "2026-11-03T19:57:14.274Z", "dateUpdated": "2026-11-03T22:39:49.653Z"}, "containers": {"cna": {"title": "upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"}, {"name": "https://github.com/networkupstools/nut/pull/3499", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/pull/3499"}, {"name": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7"}, {"name": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a"}, {"name": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"}], "affected": [{"vendor": "networkupstools", "product": "nut", "versions": [{"version": ">= 2.8.3, <= 2.8.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T19:57:14.274Z"}, "descriptions": [{"lang": "en", "value": "Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6."}], "source": {"advisory": "GHSA-mjgp-j4gm-6qg5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/01/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-03T20:10:30.152Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T22:36:38.962299Z", "id": "CVE-2026-54161", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:39:49.653Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54161", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-11T21:46:52.380Z", "datePublished": "2026-11-03T19:57:14.274Z", "dateUpdated": "2026-11-03T22:39:49.653Z"}, "containers": {"cna": {"title": "upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"}, {"name": "https://github.com/networkupstools/nut/pull/3499", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/pull/3499"}, {"name": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7"}, {"name": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a"}, {"name": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220", "tags": ["x_refsource_MISC"], "url": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"}], "affected": [{"vendor": "networkupstools", "product": "nut", "versions": [{"version": ">= 2.8.3, <= 2.8.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-03T19:57:14.274Z"}, "descriptions": [{"lang": "en", "value": "Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6."}], "source": {"advisory": "GHSA-mjgp-j4gm-6qg5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/01/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-03T20:10:30.152Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54161", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T22:36:38.962299Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T22:36:39.662Z"}}]}}

{"affected": [{"affectedData": [{"product": "nut", "vendor": "networkupstools", "versions": [{"status": "affected", "version": ">= 2.8.3, <= 2.8.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6."}], "id": "CVE-2026-54161", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54161", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T22:36:38.962299Z", "version": "2.0.3"}}]}, "published": "2026-11-03T20:18:14.243", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7"}, {"source": "security-advisories@github.com", "url": "https://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a"}, {"source": "security-advisories@github.com", "url": "https://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220"}, {"source": "security-advisories@github.com", "url": "https://github.com/networkupstools/nut/pull/3499"}, {"source": "security-advisories@github.com", "url": "https://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/01/10"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nut: nut: Arbitrary command execution via unsanitized alarm notifications in upsmon", "id": "2566249", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566249"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.", "A flaw was found in Network UPS Tools (NUT). An attacker capable of intercepting or controlling communications from an upstream server or monitored device can achieve arbitrary command execution with the privileges of the monitoring client, typically root. This issue occurs because the upsmon monitoring client incorporates server-supplied alarm messages directly into shell notification commands without adequate sanitization, allowing shell metacharacters to be executed."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, disable external command execution for alarm notifications in the upsmon configuration:\n1. Edit `/etc/ups/upsmon.conf` and locate the `NOTIFYFLAG ALARM` directive. Ensure the `EXEC` flag is omitted (for example, configure `NOTIFYFLAG ALARM SYSLOG` or remove `EXEC` from any combined flags such as `NOTIFYFLAG ALARM SYSLOG+WALL`). Alternatively, unset or comment out the `NOTIFYCMD` directive if external notification scripts are not required.\n2. Restart the monitoring daemon to apply the configuration change:\n```\nsystemctl restart nut-monitor\n```\nWarning: Restarting the `nut-monitor` daemon temporarily interrupts active UPS monitoring until the service initializes.\nCaveats:\nDisabling the `EXEC` flag prevents upsmon from executing custom external scripts or handlers when an alarm event is triggered by a monitored device."}, "name": "CVE-2026-54161", "public_date": "2026-11-03T19:57:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54161\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54161\nhttps://github.com/networkupstools/nut/commit/98e073d4cc31f9c73e2fa0c2677540487d902fe7\nhttps://github.com/networkupstools/nut/commit/dffba911504866695be698bb5ec49eac40d0f66a\nhttps://github.com/networkupstools/nut/commit/ecf98e7542e4ae2b62b211622ee26989274b2220\nhttps://github.com/networkupstools/nut/pull/3499\nhttps://github.com/networkupstools/nut/security/advisories/GHSA-mjgp-j4gm-6qg5"], "statement": "This vulnerability is rated as Important because successful exploitation can allow arbitrary command execution with elevated root privileges, though it requires specific non-default notification directives alongside an untrusted or compromised upstream monitoring stream. In typical deployments, triggering the flaw requires an attacker to control or alter telemetry through a compromised upstream daemon, network-level manipulation, or rogue hardware. Furthermore, exposure is limited to environments where upsmon has been configured with the EXEC flag on ALARM notifications to dispatch external scripts.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.8.3,2.8.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nut", "source": "cna", "vendor": "networkupstools"}, "product": "nut", "vendor": "networkupstools"}], "created": "2026-11-03T23:45:04.531780+00:00", "updated": "2026-11-04T02:30:07.193696+00:00", "vendors": ["networkupstools", "networkupstools$PRODUCT$nut"]}