EUVD-2026-88211
GHSA-6x6g-w7q4-663p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated overflow with no user interaction and likely full code execution on the device; scope unchanged as impact stays within the single embedded system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A stack-based buffer overflow in the devdiscover service of FAST FAC1900R firmware 20190827_2.0.2 lets unauthenticated remote attackers corrupt stack memory by sending a crafted message to the copy_msg_element function, with high impact on confidentiality, integrity, and availability. The flaw is remotely reachable with no privileges or user interaction required (CVSS:4.0 base 9.3; independent assessment of 3.1/AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), and publicly available exploit code exists, so any deployment where the service is reachable - typically LAN-adjacent, or WAN-exposed if the device forwards the service externally - is at risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the FAST FAC1900R's devdiscover service, which parses discovery messages via copy_msg_element; a crafted oversized message triggers the stack overflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and subsequent-system SC:H/SI:H/SA:H, yielding 9.3) describes a remotely reachable, unauthenticated stack-based buffer overflow requiring no user interaction - on paper a critical, wormable-class flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis: the vendor was contacted early but did not respond, so there is no fixed firmware version to recommend for FAST FAC1900R 20190827_2.0.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FAST FAC1900R devices running firmware 20190827_2.0.2 and immediately isolate them from untrusted networks by blocking access to the devdiscover service at the perimeter and internal segmentation points; if the service is not essential, disable it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A command injection vulnerability (CVSS 9.8). Risk factors: public PoC available.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stem
Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
An unauthenticated OS command injection in the CGI handler of Netcore NR289-GE firmware 1.4.5102 lets remote attackers e
Unauthenticated network attackers can bypass authentication in the Netcore NR289-GE router's boa_temp web handler and ab
Remote unauthenticated OS command injection in Netcore NR289-GE firmware 1.4.5102 allows attackers to execute arbitrary
Unauthenticated OS command injection in the Netcore NR289-GE router (firmware 1.4.5102) lets any remote attacker who can
RIOT IoT operating system has an out-of-bounds read vulnerability (CVSS 9.1) that could lead to information disclosure o
Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege aut
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operatin
OS command injection in the Ziroom ZHOME A0101 smart-home device (firmware 1.0.1.0) allows an attacker who can reach the
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today