CVE-2026-103432
HighCVSS 8.1Summary
apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.
Risk Assessment
The risk includes the possibility of remote code execution or denial of service by sending specially crafted data to CGI, potentially leading to system compromise.
Recommendation
Update apcupsd to a version newer than 3.14.14. Restrict access to CGI scripts and monitor network traffic.
Other vulnerabilities in apcupsd
See all- CVE-2026-103436Low
Vulnerability in apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi). On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.
- CVE-2026-15545High
In Shibby Tomato up to version 1.28.0000, a vulnerability was found in the main function of the file www/apcupsd/tomatodata.cgi of the apcupsd component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS