FAST FAC1203R CVE-2026-101354

Exploitation requires the attacker to be on the same local network segment as the router (CVSS AV:A) - for example connected to its WiFi or LAN - and to send crafted input that reaches the MmtAtePrase parser processed by the _tWlanTask function. No authentication (PR:N) and no user interaction (UI:N) are needed once local network access is obtained. The primary limiting factor is this adjacency requirement: the flaw is not reachable from the internet in a default deployment, so exposure is confined to attackers with LAN/WiFi presence. No non-default configuration is indicated; the vulnerable parser appears reachable on the affected firmware build 20200116_2.0.4. No vendor patch is available.

This is a genuine but access-constrained priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) shows an adjacent-network, low-complexity, unauthenticated attack with high vulnerable-system confidentiality, integrity and availability impact - a stack-based buffer overflow (CWE-121) that plausibly yields code execution on the router. The single most important limiter is AV:A: the attacker must already be on the local/WiFi network, which sharply narrows the exploit population versus an internet-facing (AV:N) flaw. Exploitation status is 'publicly available exploit code exists' (VulDB E:P plus a GitHub PoC), but this is NOT active exploitation - there is no CISA KEV listing and no EPSS score in the provided data, so widespread automated abuse is unproven. Note a discrepancy worth verifying: the vendor 4.0 vector sets subsequent-system SC/SI/SA:H, but nothing in the description indicates the overflow crosses a security boundary onto a separate system, so the scope-change/subsequent impact appears overstated. The vendor was contacted and did not respond, meaning no patch exists - a factor that raises operational risk for exposed devices even though real-world reach is limited by the adjacent-only vector.

An attacker who has joined the target's WiFi or LAN (e.g., a guest network, café, or compromised local host) sends crafted input to the MmtAtePrase parser handled by the _tWlanTask function on a FAST FAC1203R router. The malformed data overflows a stack buffer, allowing the attacker to crash the device or execute arbitrary code and take control of the router. Public exploit code exists (GitHub PoC referenced by VulDB), lowering the skill required.