{"id":"DEBIAN-CVE-2026-85068","details":"Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.","modified":"2026-11-06T17:30:47.820929063Z","published":"2026-11-05T23:17:00.947Z","upstream":["CVE-2026-85068"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-85068"}],"affected":[{"package":{"name":"nut","ecosystem":"Debian:12","purl":"pkg:deb/debian/nut?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.0-7","2.8.1-1","2.8.1-2","2.8.1-3","2.8.1-3.1","2.8.1-3.1~exp1","2.8.1-3.1~exp2","2.8.1-3.2","2.8.1-3.3","2.8.1-4","2.8.1-4.1","2.8.1-5","2.8.3-1","2.8.3-2","2.8.3-3","2.8.4+really-1","2.8.4+really-2","2.8.4+really-2.1","2.8.4-1~exp1","2.8.5-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-85068.json"}},{"package":{"name":"nut","ecosystem":"Debian:13","purl":"pkg:deb/debian/nut?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1-5","2.8.1-5+deb13u1","2.8.3-1","2.8.3-2","2.8.3-3","2.8.4+really-1","2.8.4+really-2","2.8.4+really-2.1","2.8.4-1~exp1","2.8.5-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-85068.json"}},{"package":{"name":"nut","ecosystem":"Debian:14","purl":"pkg:deb/debian/nut?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.1-5","2.8.3-1","2.8.3-2","2.8.3-3","2.8.4+really-1","2.8.4+really-2","2.8.4+really-2.1","2.8.4-1~exp1","2.8.5-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-85068.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}