CVE-2026-85068 in nut
Summary
by MITRE • 11/06/2026
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
Network UPS Tools serves as a critical infrastructure component for system administrators seeking to monitor uninterruptible power supplies, power distribution units, and similar hardware through a unified interface. Within the codebase spanning versions two point four two through two point eight five, a specific implementation flaw exists in the blazer_usb driver module which handles communication with USB-connected devices using the Megatec protocol variant known as ippon_command. The technical root cause of this vulnerability lies in improper memory initialization practices within the C programming language context. Specifically, when processing certain status queries, the function allocates and utilizes a character array named tmp with a size of sixty-four bytes but fails to fully initialize all elements before use. While the initial portion of this buffer is populated with data derived from short Megatec status responses, the remaining trailing bytes retain whatever values were previously present on the stack memory location allocated for that variable.
This uninitialized memory state becomes particularly dangerous when the driver subsequently passes a fixed eight-byte chunk to the usb_control_msg function for transmission over the USB bus. Because the buffer is not zeroed out or explicitly filled before this operation, any residual data lingering in the upper regions of the tmp array remains intact and accessible during normal polling cycles performed by the NUT software. A malicious actor who controls a USB device presenting the specific vendor identifier zerox06da and product identifier zerox0003 associated with Mustek Powermust hardware can exploit this condition. By matching the blazer_usb_id table entry to select the ippon_subdriver, such a compromised or rogue peripheral device triggers the polling mechanism that reads from the partially initialized buffer. Consequently, during these routine interactions, the trailing uninitialized stack bytes are exposed and transmitted as part of the data payload sent via usb_control_msg.
The operational impact of this vulnerability is primarily characterized by an information disclosure risk rather than immediate integrity compromise or availability disruption. The flaw allows for a read-only extraction of sensitive kernel memory contents that may include pointers to other functions, environment variables, passwords, or cryptographic keys previously stored on the stack in adjacent allocations. This constitutes a classic case of CWE-200 where exposure of readable information occurs due to improper resource initialization. However, the attack vector is strictly bounded by physical proximity requirements. An attacker must possess direct access to the USB bus connecting the host system running Network UPS Tools or have compromised the supply chain integrity of the connected hardware device itself. Without such physical control over the peripheral interface, remote exploitation via network vectors is not feasible given that this vulnerability resides in local driver code handling internal hardware communication protocols rather than external API endpoints.
From a threat intelligence perspective aligned with MITRE ATT&CK frameworks, this scenario maps to techniques involving data exfiltration from memory through direct device interaction or supply chain compromise scenarios where trusted peripherals are subverted. The lack of established integrity or availability impact means that while the confidentiality of system state is compromised, the attacker cannot directly alter configuration files, crash services, or execute arbitrary code based solely on this buffer overflow condition in its current form. Mitigation strategies should focus on immediate patching to version two point eight six where the initialization flaw has been addressed by ensuring complete zeroing or explicit filling of the tmp array before any data transmission occurs. In environments where upgrading is not immediately possible, administrators can mitigate risk by physically isolating systems running vulnerable versions from untrusted USB peripherals and enforcing strict device control policies that prevent unauthorized hardware attachment to management stations critical for power infrastructure monitoring.