EUVD-2026-85014
GHSA-fgvq-2jw8-748x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Device Discovery Service on network
-
DeliverySend crafted discovery message
-
ExploitOverflow stack buffer in copy_msg_element
-
ExecutionOverwrite return address
-
PersistExecute code on router
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Device Discovery Service of a FAST FAC1203R Gigabit Edition 2.0.4 router; no authentication, credentials, or user interaction are needed (PR:N/UI:N/AC:L). The practical limiter is network position: device discovery protocols on embedded routers are typically LAN/broadcast-scoped, so an attacker most likely needs adjacent (same-subnet) access rather than internet routing, despite VulDB labeling the vector 'remote'/AV:N. No patch is available (vendor did not respond), so the only mitigations are restricting/segmenting access to the discovery service and blocking untrusted hosts on the local network. |
| Impact | This is a genuinely high-priority issue if the affected service is reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes an unauthenticated, low-complexity, no-interaction stack-based buffer overflow yielding full compromise, and E:P plus the description ('The exploit has been published and may be used') confirms proof-of-concept exploit code is public. It is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active mass exploitation yet - POC availability is a distinct, lower signal than confirmed in-the-wild use. Two data caveats temper the raw 9.3: (1) VulDB scored subsequent-system impact SC:H/SI:H/SA:H, but for a standalone consumer router being fully compromised there is no separate downstream system, so that scope inflation is questionable; (2) the flaw lives in a 'Device Discovery Service', which on embedded/VxWorks routers is typically a LAN-scoped multicast/broadcast protocol - VulDB's AV:N ('remote') may in practice mean adjacent/LAN rather than internet-routable, which would materially lower real-world exposure. The vendor was contacted and did not respond, so no patch is expected - verify network exposure and segment the discovery service. |
| Exploit ScenarioDerived | An attacker on the same network segment as the router sends a crafted Device Discovery Service message with an oversized element that overflows a stack buffer in copy_msg_element, overwriting the return address and executing attacker-controlled code with the service's privileges. A public proof-of-concept exists (VulDB E:P), lowering the barrier to weaponization; because no authentication or user interaction is required (PR:N/UI:N/AC:L), a single packet can achieve full device takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Remote stack-based buffer overflow in the Device Discovery Service of FAST FAC1203R Gigabit Edition 2.0.4 routers allows unauthenticated attackers to execute arbitrary code via a crafted message processed by the copy_msg_element function. A public proof-of-concept exploit has been published, and the vendor has not released a patch. While the CVSS vector indicates network exploitable (AV:N), the discovery service is typically limited to the LAN broadcast domain, so attackers most likely need adjacent network access rather than internet routing.
RemediationAI
No vendor-released patch is available at the time of analysis, as the vendor did not respond to the disclosure. The primary mitigation is to restrict network access to the Device Discovery Service: place the router on a dedicated, isolated VLAN and block all untrusted hosts from reaching the discovery protocol port or the device management interface. If the discovery feature can be disabled via configuration, doing so would eliminate the attack vector, though this may break automatic device discovery or management functionality. Network segmentation and firewall rules should be applied to prevent lateral movement from compromised hosts on the same subnet. Monitor for anomalous traffic to the discovery service and consider replacing the device if a secure alternative is available. Refer to the VulDB advisory at https://vuldb.com/vuln/408707 for updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic stack-based buffer overflow (CWE-119) in the copy_msg_element function of the Device Discovery Service, a component that parses discovery protocol messages on FAST FAC1203R Gigabit Edition routers. The function fails to validate the length of input data before copying it into a fixed-size stack buffer, allowing an attacker to overwrite adjacent memory and potentially hijack control flow. The attack is network-accessible with no authentication or user interaction (PR:N/UI:N), and the published exploit demonstrates a proof-of-concept (E:P). The root cause is improper bounds checking on buffer copies, a common flaw in embedded device firmware where memory safety is often not enforced.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated no-interaction memory-corruption RCE gives full C/I/A; kept AV:N per the advisory though a LAN-only discovery service would justify AV:A, and S:U since the router is a single compromised component.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using FAST FAC1203R Gigabit Edition 2.0.4 routers face a critical remote code execution risk in the Device Discovery Service; publicly available exploit code exists and no vendor-released patch identified at time of analysis. Because these devices can sit at branch or edge network boundaries, a compromise could disrupt connectivity, expose internal traffic, or provide a foothold for lateral movement. Leadership should treat this as an urgent network infrastructure risk requiring immediate inventory validation, containment, and mitigation planning.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the Device Discovery Service where not operationally required; segment and firewall discovery traffic so it is limited to trusted LAN hosts; reduce broadcast domains; monitor router logs and network traffic for abnormal discovery requests or device restarts; and isolate affected routers until a patch or replacement is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB