nut upsmon passes unchecked alarm text to shell commands
A power-backup monitoring tool can let attackers take over your computer.
Summary
The upsmon client in nut inserts alarm values from the server into shell commands, so an attacker can run operating-system commands. Versions 2.8.3 through 2.8.5 are affected when alarm notifications run a command.
Affected when
- NOTIFYCMD with EXEC set for ALARM notifications
- attacker can alter the alarm value from upsd or a UPS device
What to do
Update to 2.8.6.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen