CVE-2026-85068
Dashboard / Vulnerabilities / CVE-2026-85068
Summary: NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg
Details: Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.
References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85068.json, https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8, https://nvd.nist.gov/vuln/detail/CVE-2026-85068, https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3, https://github.com/networkupstools/nut/pull/3529
Affected packages
Package
Name:
Purl:
Affected ranges
Type: GIT
Events:
