---
id: CVE-2026-85068
title: >-
  NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in
  OUT-direction usb_control_msg
summary: >-
  Network UPS Tools is a collection of programs which provide a common interface
  for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through
  2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char
  tmp[64]…
severity: low
cvss: 2.4
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-457
vendor: networkupstools
product: nut
affected:
  - 'nut >= 2.4.2, <= 2.8.5'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:57:24.731Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85068'
references:
  - url: >-
      https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8
    label: >-
      https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8
  - url: 'https://github.com/networkupstools/nut/pull/3529'
    label: 'https://github.com/networkupstools/nut/pull/3529'
  - url: >-
      https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3
    label: >-
      https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.933Z'
epss: 0.00151
epssPercentile: 0.0423
---

## Overview

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.

## Affected

- `nut >= 2.4.2, <= 2.8.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.