The issue arises in the ippon_command function of the blazer_usb driver, where a 64‑byte temporary buffer is only partially initialized before a fixed eight‑byte usb_control_msg is transmitted. A USB device that advertises the Mustek Powermust VID 0x06da and PID 0x0003 can be selected by the driver, causing normal polling to read the uninitialized trailing bytes of the buffer. Because the buffer contains leftover stack data, an attacker can leak part of the host's stack memory. The leak is read‑only, does not compromise integrity or availability, and its scope is limited to disclosed stack contents.

Network UPS Tools (nut) releases 2.4.2 through 2.8.5 include the vulnerable ippon_command implementation in drivers/blazer_usb.c. All installations of nut that use this driver are affected, regardless of other configurations.

The CVSS score of 2.4 indicates a low severity risk, and the EPSS score is < 1%, implying very low known exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious USB device that the system regards as a Mustek Powermust, meaning the attacker needs physical or supply‑chain access to the USB bus. The exposure is bounded, read‑only, and offers only limited data leakage.