CVE-2026-103436
LowCVSS 3.7Summary
Vulnerability in apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi). On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.
Risk Assessment
Risk of leaking sensitive stack memory data in HTTP responses, potentially leading to information disclosure.
Recommendation
Update apcupsd to a version newer than 3.14.14 that includes the fix.
Other vulnerabilities in apcupsd
See all- CVE-2026-103432High
apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.
- CVE-2026-15545High
In Shibby Tomato up to version 1.28.0000, a vulnerability was found in the main function of the file www/apcupsd/tomatodata.cgi of the apcupsd component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS