DEBIAN-CVE-2026-85068

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-85068

    DEBIAN-CVE-2026-85068

    Published: 5 Nov 2026Last Modified: 6 Nov 2026
    Upstream:
    CVE-2026-85068

    Summary:

    Details: Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.

    References: https://security-tracker.debian.org/tracker/CVE-2026-85068

    Affected packages

    Package

    Name: nut

    Purl: pkg:deb/debian/nut?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    2.8.0-7
    2.8.1-1
    2.8.1-2
    2.8.1-3
    2.8.1-3.1
    2.8.1-3.1~exp1
    2.8.1-3.1~exp2
    2.8.1-3.2
    2.8.1-3.3
    2.8.1-4
    2.8.1-4.1
    2.8.1-5
    2.8.3-1
    2.8.3-2
    2.8.3-3
    2.8.4+really-1
    2.8.4+really-2
    2.8.4+really-2.1
    2.8.4-1~exp1
    2.8.5-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-85068 | CVE-DB