{"id":"CVE-2026-85068","kind":"vulnerability","aliases":["CVE-2026-85068"],"related":[],"title":"Network UPS Tools: uninitialized stack bytes leak to a rogue USB UPS","description":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.","summary":"Network UPS Tools reads status from UPS hardware over USB, and a malicious USB device posing as a Mustek Powermust UPS can receive leftover stack memory during normal polling. The attacker gets a bounded, read-only disclosure of uninitialized memory bytes, with no integrity or availability impact.","severity":"low","cvss":2.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["homelab","linux","network-ups-tools","package","self-hosted"],"not_affected_if":["no-usb-ups","non-blazer-driver","version-2.8.6-or-later"],"how_to_check":"- Check the installed NUT version with `upsd -V` or `upsc -V`, and confirm whether the `blazer_usb` driver with the `ippon` subdriver is in use via `grep -r ippon /etc/nut/`.\n- Look for USB UPS devices with vendor ID `0x06da` and product ID `0x0003` using `lsusb`.","fix":"- Network UPS Tools: move to `2.8.6`, which the sources say is the scheduled fixed version.","status":"open","published_at":"2026-11-05T23:17:00+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","triaged_at":"2026-11-05T23:49:50+00:00","updated_at":"2026-11-05T23:49:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T23:49:50Z","model":"claude-haiku-5-5","output":{"fix":"- Network UPS Tools: move to `2.8.6`, which the sources say is the scheduled fixed version.","reach":"local","title":"Network UPS Tools: uninitialized stack bytes leak to a rogue USB UPS","impact":"low","summary":"Network UPS Tools reads status from UPS hardware over USB, and a malicious USB device posing as a Mustek Powermust UPS can receive leftover stack memory during normal polling. The attacker gets a bounded, read-only disclosure of uninitialized memory bytes, with no integrity or availability impact.","audience":"businesses","category":"package","nicknames":[],"who_cares":["network-ups-tools","linux","homelab","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Uninitialized stack bytes readable by a rogue USB device","analyst_note":"","how_to_check":"- Check the installed NUT version with `upsd -V` or `upsc -V`, and confirm whether the `blazer_usb` driver with the `ippon` subdriver is in use via `grep -r ippon /etc/nut/`.\n- Look for USB UPS devices with vendor ID `0x06da` and product ID `0x0003` using `lsusb`.","plain_action":"","needs_analyst":false,"not_affected_if":["no-usb-ups","non-blazer-driver","version-2.8.6-or-later"],"who_is_affected":"Only systems running Network UPS Tools from 2.4.2 through 2.8.5 with the blazer_usb driver and ippon subdriver, talking to a USB UPS that presents the Mustek Powermust ID. Exposure requires physical or supply-chain access to the USB bus, so systems without such a device attached can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000768,"input_tokens":4438,"output_tokens":648,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-85068':15A,18A '0x0003':148C '0x06da':143C '2.4.2':100C '2.8.5':102C '2.8.6':203C '64':111C 'access':181C 'administ':93C 'attack':59B 'avail':75B,192C 'blazer':150C 'bound':62B,170C 'bus':185C 'byte':6A,70B,125C,163C 'chain':180C 'char':109C 'chunk':126C 'collect':82C 'command':104C 'common':88C 'control':129C,135C 'cve':13A,16A 'devic':43B,137C 'disclosur':66B,168C 'drivers/blazer_usb.c':106C 'eight':124C 'eight-byt':123C 'establish':189C 'firmwar':134C 'firmware-control':133C 'fix':122C,200C 'get':60B 'hardwar':36B,98C 'homelab':19B 'host':28B 'id':152C 'impact':76B,193C 'initi':108C 'integr':73B,190C 'interfac':89C 'ippon':103C,154C 'issu':195C 'leak':7A 'leftov':52B 'linux':20B 'malici':41B,132C 'match':149C 'megatec':115C 'memori':54B,69B 'monitor':91C 'msg':130C 'mustek':47B,140C,145C 'network':1A,22B,29B,77C 'network-ups-tool':21B 'normal':56B,165C 'packag':25B 'partial':107C 'pass':120C 'pdu':95C 'physic':176C 'pid':147C 'poll':57B,166C 'pose':44B 'powermust':48B,141C,146C 'present':138C 'program':84C 'provid':86C 'queri':117C 'read':32B,64B,173C 'read-on':63B,172C 'receiv':51B,158C 'requir':175C 'rogu':10A 'scd':97C 'schedul':197C 'select':153C 'self':27B 'self-host':26B 'short':114C 'stack':5A,53B,162C 'status':33B,116C 'subdriv':155C 'suppli':179C 'supply-chain':178C 'tmp':110C 'tool':3A,24B,31B,79C 'trail':161C 'uniniti':4A,68B,160C 'up':2A,12A,23B,30B,35B,49B,78C,94C 'usb':11A,38B,42B,128C,136C,151C,184C 'version':202C 'vid':142C","nicknames":[],"mitigations":[],"who_affected":"Only systems running Network UPS Tools from 2.4.2 through 2.8.5 with the blazer_usb driver and ippon subdriver, talking to a USB UPS that presents the Mustek Powermust ID. Exposure requires physical or supply-chain access to the USB bus, so systems without such a device attached can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["homelab","linux","low","networkupstools","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-08-27T14:50:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85068","severity":null,"published_at":"2026-11-05T23:17:00+00:00","modified_at":"2026-11-05T23:17:00+00:00","first_seen_at":"2026-11-05T23:48:39+00:00","fetched_at":"2026-11-05T23:48:39+00:00","note":null}],"documents":[{"id":81486,"url":"https://github.com/networkupstools/nut/commit/30d56d4282f823949b40763d5c76461c7dd107b3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81487,"url":"https://github.com/networkupstools/nut/security/advisories/GHSA-fjxc-2vpv-mqc8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-27T14:50:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}