Shell Command Injection Vulnerability in Network UPS Tools by Network UPS Tools

CVE-2026-54161

What is CVE-2026-54161?

Network UPS Tools versions 2.8.3 to 2.8.5 contain a vulnerability in the upsmon component, which can lead to arbitrary command execution. The issue arises when the ups.alarm value, provided by the monitored devices, is inserted into shell commands without sufficient sanitization. This allows attackers to exploit the command injection through a malicious upsd server or compromised UPS device. The risk persists regardless of the connection's encryption status, as the compromised device route remains vulnerable. Users are advised to upgrade to version 2.8.6 to address this critical security flaw.

References