CVE-2026-85068 · Package
NO FIX YET · SEE WHAT TO DO
Network UPS Tools reads status from UPS hardware over USB, and a malicious USB device posing as a Mustek Powermust UPS can receive leftover stack memory during normal polling. The attacker gets a bounded, read-only disclosure of uninitialized memory bytes, with no integrity or availability impact.
first public Aug 27, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only systems running Network UPS Tools from 2.4.2 through 2.8.5 with the blazer_usb driver and ippon subdriver, talking to a USB UPS that presents the Mustek Powermust ID. Exposure requires physical or supply-chain access to the USB bus, so systems without such a device attached can skip it.
Not affected if no-usb-ups, non-blazer-driver, version-2.8.6-or-later
Who cares homelab, linux, network-ups-tools, self-hosted
upsd -V or upsc -V, and confirm whether the blazer_usb driver with the ippon subdriver is in use via grep -r ippon /etc/nut/.0x06da and product ID 0x0003 using lsusb.Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.8.6, which the sources say is the scheduled fixed version.NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.