CVE-2026-54161
Description
A flaw was found in Network UPS Tools (NUT). An attacker capable of intercepting or controlling communications from an upstream server or monitored device can achieve arbitrary command execution with the privileges of the monitoring client, typically root. This issue occurs because the upsmon monitoring client incorporates server-supplied alarm messages directly into shell notification commands without adequate sanitization, allowing shell metacharacters to be executed.
Statement
This vulnerability is rated as Important because successful exploitation can allow arbitrary command execution with elevated root privileges, though it requires specific non-default notification directives alongside an untrusted or compromised upstream monitoring stream. In typical deployments, triggering the flaw requires an attacker to control or alter telemetry through a compromised upstream daemon, network-level manipulation, or rogue hardware. Furthermore, exposure is limited to environments where upsmon has been configured with the EXEC flag on ALARM notifications to dispatch external scripts.
Mitigation
To mitigate this vulnerability, disable external command execution for alarm notifications in the upsmon configuration:
1. Edit `/etc/ups/upsmon.conf` and locate the `NOTIFYFLAG ALARM` directive. Ensure the `EXEC` flag is omitted (for example, configure `NOTIFYFLAG ALARM SYSLOG` or remove `EXEC` from any combined flags such as `NOTIFYFLAG ALARM SYSLOG+WALL`). Alternatively, unset or comment out the `NOTIFYCMD` directive if external notification scripts are not required.
2. Restart the monitoring daemon to apply the configuration change:
systemctl restart nut-monitor
Warning: Restarting the `nut-monitor` daemon temporarily interrupts active UPS monitoring until the service initializes.
Caveats:
Disabling the `EXEC` flag prevents upsmon from executing custom external scripts or handlers when an alarm event is triggered by a monitored device.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate shell invocation in upsmon notification handling by executing external binaries directly with discrete argument arrays: upgrade to nut 2.8.6 (or the fixed Nut builds), which replace system() invocation with direct execution using argv arrays passed to execvp() on POSIX and _spawnvp() on Windows, closing all 3 injection vectors (compromised or rogue upsd server alarm notification, man-in-the-middle network interception of plaintext upsd-to-upsmon telemetry, compromised UPS hardware or driver injecting crafted alarm messages). Until patched, this is a concern on Deployments running upsmon configured with NOTIFYFLAG ALARM containing EXEC and a NOTIFYCMD directive, so Omit the EXEC flag from NOTIFYFLAG ALARM or comment out NOTIFYCMD in upsmon.conf, and isolate or authenticate upstream upsd communications and UPS device inputs. As a compensating measure, Configure auditd rules to monitor unauthorized child process creation and anomalous shell invocations spawned by upsmon, Enforce SELinux confinement on the upsmon process and child domains to limit unauthorized root actions, Enable systemd sandbox directives including PrivateDevices, PrivateTmp, and ProtectSystem to restrict filesystem and device access, and Apply input validation to reject alarm messages containing shell metacharacters before dispatch to the notification handler. These controls limit blast radius and contain exploitation, but they do not fix the underlying command injection defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1307 Command Injection Prevention (No Shell Invocation) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
