CVE-2026-101038
CriticalCVSS 9.9Summary
A vulnerability was determined in FAST FAC1200R version 5.0_20201119_1.0.2 in the MmtAtePrase function of the MmtAtePrase Parser component. Manipulation causes a stack-based buffer overflow, and remote exploitation is possible. The exploit has been publicly disclosed and may be utilized; the vendor did not respond to the disclosure.
Risk Assessment
A remote attacker could exploit the buffer overflow to execute arbitrary code or cause a device crash, potentially taking control of the network device. The public availability of the exploit increases the risk.
Recommendation
Due to the vendor's lack of response and the publicly disclosed exploit, it is recommended to isolate the device from public networks, restrict access to the service, and consider replacing the device with a supported model.
Other vulnerabilities in FAST FAC1200R
See all- CVE-2026-101037Critical
A vulnerability was found in FAST FAC1200R version 5.0_20201119_1.0.2 in the parse_advertisement_frame function of the devdiscover Service component. Manipulation results in a stack-based buffer overflow, and the attack may be launched remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.
- CVE-2025-50402Critical
FAST FAC1200R router (F400_FAC1200R_Q) is vulnerable to buffer overflow in function sub_80435780 via the string parameter fac_password.
- CVE-2025-50399Critical
FAST FAC1200R router (F400_FAC1200R_Q) is vulnerable to buffer overflow in function sub_80435780 via the password parameter.
Original NVD description (English source)
A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS