Description
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-23
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Restrict Access
AI Analysis

Impact

The Fast FAC1203R Gigabit Edition 2.0.4 contains a stack-based buffer overflow in the Device Discovery Service function copy_msg_element. Maliciously crafted input can overflow the stack, corrupt control data, and allow an attacker to execute arbitrary code on the device. The vulnerability is categorized as CWE‑119 and CWE‑121, with a CVSS score of 10 indicating critical severity.

Affected Systems

Affected devices are Fast FAC1203R Gigabit Edition units running firmware version 2.0.4. No other versions are listed as affected.

Risk and Exploitability

The flaw is exploitable remotely, as the exploit can be triggered from outside the local network. An exploit has already been published, and the vulnerability is not yet listed in CISA KEV. With a CVSS rating of 10, the risk is extremely high; if compromised, an attacker could gain full control of the device, leading to potential network-wide attacks or persistence. The EPSS score of 1% indicates a low but non‑zero probability that the vulnerability will be actively exploited in the wild.

Generated by OpenCVE AI on September 23, 2026 at 16:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑released firmware patch that corrects the copy_msg_element buffer overflow (CWE‑119, CWE‑121).
  • Restrict external access to the Device Discovery Service by configuring firewalls or network segmentation so only trusted hosts can reach it, thereby preventing remote exploitation of the stack overflow.
  • Enforce strict input validation and bounds checking on message elements to ensure that their lengths do not exceed buffer limits, mitigating CWE‑119 and CWE‑121.
  • Monitor network traffic for anomalous patterns targeting the Device Discovery Service and set up alerts to detect attempted exploitation attempts.

Generated by OpenCVE AI on September 23, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 03:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow
First Time appeared Fast
Fast fac1203r Gigabit Edition
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:fast:fac1203r_gigabit_edition:*:*:*:*:*:*:*:*
Vendors & Products Fast
Fast fac1203r Gigabit Edition
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Fast Fac1203r Gigabit Edition
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-23T14:07:16.689Z

Reserved: 2026-09-22T19:50:34.933Z

Link: CVE-2026-96257

cve-icon Vulnrichment

Updated: 2026-09-23T14:07:12.593Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T03:17:06.077

Modified: 2026-09-23T15:17:31.920

Link: CVE-2026-96257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T16:45:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow