CVE-2026-101354

FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Description
A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability is a stack-based buffer overflow in the _tWlanTask function of the MmtAtePrase Parser component. A crafted packet received via the WLAN interface can overwrite the stack and potentially allow an attacker to execute arbitrary code on the device. The flaw is exploitable by an actor with local network access and the exploit code has been made publicly available.

Affected Systems

FAST FAC1203R devices running firmware 20200116_2.0.4 are affected. The specific vendor product is FAST FAC1203R, and the vulnerability resides in the FAC1203R platform’s WLAN task module.

Risk and Exploitability

The CVSS score of 9.4 classifies this flaw as critical. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the public release of exploit code indicates a high likelihood of real-world attacks. The attack vector requires an attacker to have local network presence, but once that foothold exists, execution can be achieved.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FAST FAC1203R firmware to a patched version that addresses the _tWlanTask buffer overflow if one is available from the vendor.
  • Restrict or disable the WLAN interface on the device or segregate it behind strict firewall rules to prevent untrusted local network traffic from reaching the vulnerable function.
  • Implement network segmentation and monitor WLAN traffic for anomalous patterns indicative of an exploit attempt; consider deploying IDS/IPS tuned to detect suspicious packets targeting the device.

Generated by OpenCVE AI on September 29, 2026 at 02:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow
First Time appeared Fast
Fast fac1203r
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:fast:fac1203r:*:*:*:*:*:*:*:*
Vendors & Products Fast
Fast fac1203r
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:A/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.6, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 10:45 AM
Reserved
Sep 28, 2026, 3:23 PM

View source JSON

Updated
Sep 29, 2026, 10:45 AM

JSON

Status
Deferred
Published
Sep 29, 2026, 2:16 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 29, 2026, 1:19 PM

JSON