CVE-2026-101037
CriticalCVSS 9.9Summary
A vulnerability was found in FAST FAC1200R version 5.0_20201119_1.0.2 in the parse_advertisement_frame function of the devdiscover Service component. Manipulation results in a stack-based buffer overflow, and the attack may be launched remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.
Risk Assessment
A remote attacker could exploit the buffer overflow to execute arbitrary code or cause a device crash, potentially taking control of the network device. The public availability of the exploit increases the risk.
Recommendation
Due to the vendor's lack of response and the public exploit, it is recommended to isolate the device from public networks, restrict access to the devdiscover service, and consider replacing the device with a supported model.
Other vulnerabilities in FAST FAC1200R
See all- CVE-2026-101038Critical
A vulnerability was determined in FAST FAC1200R version 5.0_20201119_1.0.2 in the MmtAtePrase function of the MmtAtePrase Parser component. Manipulation causes a stack-based buffer overflow, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.
- CVE-2025-50402Critical
FAST FAC1200R router (F400_FAC1200R_Q) is vulnerable to buffer overflow in function sub_80435780 via the string parameter fac_password.
- CVE-2025-50399Critical
FAST FAC1200R router (F400_FAC1200R_Q) is vulnerable to buffer overflow in function sub_80435780 via the password parameter.
Original NVD description (English source)
A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS