{"id":"CVE-2026-103432","published":"2026-09-30T16:17:09.533","lastModified":"2026-09-30T20:17:31.130","description":"apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493140","tags":[]},{"url":"https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d50800550de/src/cgi/upsfetch.c#L240","tags":[]},{"url":"https://sourceforge.net/projects/apcupsd/","tags":[]}],"exploitRefs":[{"url":"https://github.com/therealbstern/apcupsd/blob/224d19d5faa508d04267f6135fe53d50800550de/src/cgi/upsfetch.c#L240","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is a stack-based buffer overflow in the getupsvar() function of apcupsd, which can lead to arbitrary code execution. This matters because it allows an attacker to exploit the vulnerability to gain control over the system.","exploitability":"Exploitation is relatively easy given the high CVSS score, and requires access to the affected web interfaces (upsstats.cgi, multimon.cgi, upsfstats.cgi).","blast_radius":"If exploited, the impact could be severe, potentially leading to complete system compromise and loss of sensitive data.","remediation":"Upgrade to apcupsd 3.14.14 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","buffer-overflow"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-05T08:43:54.053Z"}}