apcupsd CGI: Stack-based buffer overflow in getupsvar()
Summary
The CGI status pages of the apcupsd UPS monitoring software (upsstats.cgi, multimon.cgi, upsfstats.cgi) contain a stack-based buffer overflow in the function getupsvar() in src/cgi/upsfetch.c. The issue affects apcupsd up to and including 3.14.14. An unauthenticated remote attacker who can reach these CGI pages could crash the web service or potentially execute code, because the flaw is rated high for confidentiality, integrity and availability. The risk exists only where the CGI pages are installed and reachable from untrusted networks.
Affected
- apcupsd 0 to and including 3.14.14
- Components: upsstats.cgi, multimon.cgi, upsfstats.cgi (src/cgi/upsfetch.c)
- Distribution packages: apcupsd-cgi (Ubuntu); Debian bookworm and trixie listed as vulnerable
Fixed in
Unknown. The CVE record indicates a release newer than 3.14.14; no fixed version number or vendor advisory was found.
Workaround
- Remove or disable the apcupsd CGI scripts if they are not needed.
- Do not expose the CGI pages to the internet; limit access to the LAN or a VPN.
- Add web server authentication or IP allow-listing in front of the CGI pages.
Exploitation
- CISA SSVC: exploitation none, not automatable, technical impact total.
- Not listed in KEV.
- No public proof of concept or reports of exploitation found.
- A related issue (CVE-2026-15544, a different product) has a publicly disclosed exploit.
Our recommendation
- Check whether apcupsd CGI scripts are installed and reachable, for example on web servers or UPS management hosts.
- Immediately restrict or remove any internet-facing CGI status page.
- Update apcupsd to a release newer than 3.14.14 as soon as your distribution or the upstream project publishes a fix.
- Monitor your distribution's security tracker and the upstream project for a fixed build.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Bugzilla 2493140 bugzilla.redhat.com
- upsfetch.c at 224d19d (GitHub) github.com
- apcupsd project (SourceForge) sourceforge.net
- OpenCVE CVE-2026-103432 app.opencve.io
- Ubuntu CVE-2026-103432 ubuntu.com
- Debian Security Tracker apcupsd security-tracker.debian.org
- OSV UBUNTU-CVE-2026-103432 osv.dev
- Nixpkgs security issue apcupsd github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:07.
Original description (NVD)
apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.