{"affected":[{"product":"nut","source":"CNA: GitHub_M","vendor":"networkupstools","versions":[{"status":"affected","version":">= 2.4.2, <= 2.8.5"}]}],"cveId":"CVE-2026-85068","cwes":["CWE-457"],"description":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":2.4,"severity":"low","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1793919444731,"publishedAt":1793919444731,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/networkupstools/nut/pull/3529"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3"}],"remediation":[],"revision":"327d4d055ab9e25322195c7c68697a31377a51e85ae2cb66af34e6e5a94b2572","sources":[{"modifiedAt":1793919444731,"name":"CNA: GitHub_M","retrievedAt":1793920176811,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85068"}],"ssvc":null,"status":"published","title":"NUT blazer_usb ippon_command stack info-leak via unzeroed char tmp[64] in OUT-direction usb_control_msg","updatedAt":1793920176811}