CVE-2026-85068

Name of the Vulnerable Software and Affected Versions Network UPS Tools versions 2.4.2 through 2.8.5

Description The ippon command function in drivers/blazer usb.c partially initializes the tmp[64] character array with a short Megatec status query and subsequently passes a fixed eight-byte chunk to usb control msg(). A malicious firmware-controlled USB device using Mustek Powermust VID 0x06da and PID 0x0003 can match blazer usb id and select ippon subdriver, allowing it to receive uninitialized trailing stack bytes during normal polling. This read-only disclosure requires physical or supply-chain access to the USB bus.

Recommendations Update to version 2.8.6.