Loading vulnerability…
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a compact, working PoC for CVE-2026-54161 affecting Network UPS Tools (NUT) upsmon. It demonstrates command injection via the attacker-controlled ups.alarm value returned by a malicious upsd server. The exploit path is network-driven: upsmon connects to a server speaking the NUT protocol, receives ups.status="ALARM" and ups.alarm containing shell metacharacters, and then interpolates that value into a shell command executed through the notification mechanism. Because upsmon often runs as root, this yields privilege-bearing OS command execution. Repository structure: README.md documents the vulnerability, affected versions, and references; mock_upsd.py is the malicious TCP server that emulates upsd on 127.0.0.1:3493 and returns crafted GET VAR responses; poc_pkg.sh is the main exploit driver that configures a packaged upsmon instance, launches the malicious server, starts upsmon in debug mode, and verifies exploitation by checking for /tmp/PWNED; Dockerfile builds a Debian sid container with nut-client and Python 3 to reproduce the issue using distro packages. Main exploit capabilities: (1) emulates a malicious NUT upsd service, (2) supplies attacker-controlled ups.alarm content, (3) triggers ALARM notification handling in upsmon, and (4) achieves arbitrary shell command execution. The included payload is basic and hardcoded—$(touch /tmp/PWNED)—so the repository is best classified as OPERATIONAL rather than weaponized. It is not merely a detector: it actively attempts exploitation and confirms success through filesystem side effects and logs.
3 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.