{"id":"CVE-2026-85068","title":"NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg","summary":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64]…","severity":"low","cvss":2.4,"cvssVector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-457"],"vendor":"networkupstools","product":"nut","affected":["nut >= 2.4.2, <= 2.8.5"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:57:24.731Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85068","references":[{"url":"https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8","label":"https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8"},{"url":"https://github.com/networkupstools/nut/pull/3529","label":"https://github.com/networkupstools/nut/pull/3529"},{"url":"https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3","label":"https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T23:41:31.933Z","epss":0.00151,"epssPercentile":0.0423,"slug":"CVE-2026-85068","body":"## Overview\n\nNetwork UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.\n\n## Affected\n\n- `nut >= 2.4.2, <= 2.8.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":13,"depthScoreParts":{"impact":13.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}