CVE-2026-96257
Received Received - Intake

Stack-Based Buffer Overflow in Fast FAC1203R Gigabit Edition

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulDB

Description
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96257
EUVD
EUVD-2026-85014

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fast fac1203r From 2.0.4 (inc)
fast fac1203r 2.0.4
fast fac1203r 20200116_2.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow vulnerability in the Fast FAC1203R Gigabit Edition router firmware version 2.0.4. The flaw exists in the copy_msg_element function of the device discovery service. It fails to validate a length field from UDP packets before performing a memory copy operation. Attackers can send a specially crafted UDP packet to port 5001 with a malicious length field, causing the stack buffer to overflow and potentially execute arbitrary code.

Detection Guidance

To detect this vulnerability, monitor network traffic for UDP packets sent to port 5001. Use packet capture tools like tcpdump or Wireshark to inspect packets for unusually large TLV length fields (e.g., 0x0268). Check router logs for crashes or unusual behavior in the device discovery service.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary code on the affected device remotely. This could lead to unauthorized access, control of the router, network compromise, or disruption of services. Since the device runs on VxWorks and is exposed via UDP port 5001, systems using this firmware are at significant risk if not patched.

Mitigation Strategies

Immediately block UDP port 5001 at the network perimeter to prevent remote exploitation. Implement input validation in the copy_msg_element function to check TLV length fields. Use safe copy routines like strncpy instead of memcpy. Monitor affected devices for signs of compromise.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart