Remote OS command injection in Network UPS Tools (NUT) upsmon. An attacker who can control a UPS's ups.alarm value (malicious/compromised UPS or MITM of the driver-to-upsd channel) gets that value substituted into the NOTIFYCMD handler, which upsmon passes to system(), allowing arbitrary command execution as the upsmon process. Affects 2.8.3-2.8.5; 2.8.2 and earlier not affected.