Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54161— upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution

Quick assessment

Affected
networkupstools nut
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Network UPS Tools（NUT）是一套用于监控和管理 UPS、PDU 及 SCD 硬件的通用接口程序集合。在 2.8.3 至 2.8.5 版本中， （位于 ）会将由服务器提供的 值插入到由 、 和 函数执行的 shell 命令中。当受监控设备报告处于 ALARM（警报）状态，且操作员在 中配置了 标志（ 为 ）时，警报文本中的 shell 元字符将在 POSIX 或 Windows 系统上被解析执行，从而以 账户（通常为 root 用户）身份执行任意操作系统命令。 攻击者可通过以下途径控制该值：恶意或被

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54161

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
upsmon: remote OS command injection (RCE) via attacker-controlled ups.alarm in NOTIFYCMD execution
Source: CVE Program / CVE List V5
Vulnerability Description
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and an operator has configured NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated on POSIX or Windows and can execute arbitrary operating-system commands as the upsmon account, which is commonly root. An attacker can control the value through a malicious or compromised upsd, a man-in-the-middle on a plaintext upsd to upsmon connection, or a compromised UPS device whose driver supplies the alarm upstream of upsd; TLS between upsd and upsmon does not mitigate the compromised-device path. This vulnerability is fixed in 2.8.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
networkupstools nut >= 2.8.3, <= 2.8.5 -

II. Public POCs for CVE-2026-54161

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54161

请登录查看更多情报信息。

Other References for CVE-2026-54161 (5)

IV. Related Vulnerabilities

Same product: nut
Same vendor: networkupstools
Same weakness: CWE-78