Partial Initialization Vulnerability in Network UPS Tools Affecting USB Devices
CVE-2026-85068
2.4LOW
What is CVE-2026-85068?
A vulnerability exists in the Network UPS Tools software affecting versions from 2.4.2 to 2.8.5. The vulnerability involves the ippon_command function in the blazer_usb.c driver, which fails to fully initialize a buffer. This can allow a malicious entity with physical or supply-chain access to a compatible USB device to exploit the uninitialized memory and read sensitive data during normal operations. The affected USB devices include those with the Mustek Powermust VID 0x06da and PID 0x0003. Mitigation for this issue is scheduled for release in version 2.8.6.
Affected Version(s)
nut >= 2.4.2, <= 2.8.5