Description

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.4.2 through 2.8.5, ippon_command in drivers/blazer_usb.c partially initializes char tmp[64] with a short Megatec status query and then passes a fixed eight-byte chunk to usb_control_msg. A malicious firmware-controlled USB device presenting the Mustek Powermust VID 0x06da and Mustek Powermust PID 0x0003 matches blazer_usb_id, selects ippon_subdriver, and can receive the uninitialized trailing stack bytes during normal polling. The disclosure is bounded and read-only, requires physical or supply-chain access to the USB bus, and has no established integrity or availability impact. This issue is scheduled to be fixed in version 2.8.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.4",
  "pubDate": "2026-11-05T23:17:00.947Z",
  "pubdate": "2026-11-05T23:17:00.947Z",
  "executiveSummary": "A stack-based information disclosure vulnerability exists in the Network UPS Tools (NUT) driver blazer_usb.c component.\nThe flaw stems from the improper initialization of a character buffer used during USB control message polling, allowing uninitialized stack memory to be exposed to external hardware.\nThe vulnerability affects versions 2.4.2 through 2.8.5 of Network UPS Tools.\nSuccessful exploitation allows an attacker-controlled USB device to read sensitive stack data leaked from the driver process.\nThe risk is bounded to local information leakage and requires physical or supply-chain access to the USB bus to substitute a malicious UPS device.\nThere is no impact on system integrity or availability, as the disclosure is limited to read-only access to stack bytes retrieved during normal polling operations.",
  "technicalDetails": "The vulnerability is located within the ippon_command function in drivers/blazer_usb.c. The root cause is the incomplete initialization of a 64-byte stack-allocated character array, tmp[64].\nIn the affected versions, the ippon_command function populates this buffer with a short Megatec status query. However, the subsequent call to usb_control_msg transmits an eight-byte segment of this buffer without ensuring that the underlying memory has been zeroed or fully populated with expected data.\nThe attack vector necessitates the presence of a malicious USB device that masquerades as a Mustek Powermust UPS, specifically matching the Vendor ID (VID) 0x06da and Product ID (PID) 0x0003. This matching criteria allows the device to bind to the blazer_usb_id driver and select the ippon_subdriver.\nWhen the driver executes its periodic polling loop, it invokes ippon_command. Because the trailing bytes of the tmp buffer are not cleared before the usb_control_msg function triggers a read or write operation involving the device, the driver inadvertently transmits the uninitialized stack contents to the malicious USB device.\nThis behavior results in a leak of sensitive stack-resident information, such as return addresses, function pointers, or local variables from the NUT process. Because the communication is facilitated through standard USB polling, the malicious device acts as a passive recipient of the memory contents.\nExploitation is strictly read-only and requires an attacker to possess physical access to the USB bus or compromise the supply chain to introduce the malicious hardware. The vulnerability does not allow for arbitrary code execution, privilege escalation, or modification of system files, as it lacks the mechanisms to influence the program control flow or system state."
}