EUVD-2026-88202
GHSA-95q6-8fg4-hpvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach devdiscover service on network
-
DeliverySend crafted advertisement frame
-
ExploitOverflow fixed stack buffer in parse_advertisement_frame
-
ExecutionOverwrite saved return address
-
ImpactExecute arbitrary code on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reach to the router's devdiscover (device discovery) service and the ability to send a crafted advertisement frame parsed by parse_advertisement_frame; the CVSS vector specifies PR:L, implying some privilege/authentication is needed, though the description does not confirm the exact prerequisite and this should be verified against the device. No user interaction is required (UI:N). Limiting factors: the affected product is a single firmware build (FAST FAC1200R 5.0_20201119_1.0.2), the discovery service is typically exposed on the LAN rather than the WAN by default, and no vendor patch exists (vendor unresponsive), so realistic exposure depends on whether the service is reachable from the attacker's network segment. |
| Impact | The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N with VC:H/VI:H/VA:H and scope-change SC/SI/SA:H) rates this 8.6 (High), and the CWE-121 stack-based buffer overflow in the devdiscover service's parse_advertisement_frame realistically points to remote code execution on the router. Signal correlation: a public exploit exists (POC=YES via GitHub xiaobor123/vuls-find-VxWorks), but there is NO CISA KEV listing and NO EPSS score provided, so this is 'publicly available exploit code exists' - not confirmed active exploitation. The exploit repository path references VxWorks, implying this is a VxWorks-based embedded router firmware, consistent with a network-facing discovery daemon. Two caveats temper priority: (1) the vector claims PR:L (some authentication/privilege), yet the description only says 'launched remotely' and provides no auth detail - the PR:L is the vendor's assertion, not corroborated by the text, so verify whether the devdiscover service is actually pre-auth; (2) the scope-change/high subsequent-system metrics (SC:H/SI:H/SA:H) that inflate the score to 8.6 are questionable for a single-device router compromise and are not justified by the description. Netting out: a real RCE-class flaw in an obscure consumer/SOHO router with a public POC but no evidence of widespread or active exploitation - moderate priority for affected fleets, low priority in aggregate given the product's small footprint and unresponsive vendor (no patch). |
| Exploit ScenarioDerived | An attacker with network reach to the router's devdiscover service sends a crafted device-discovery advertisement frame whose fields overflow a fixed stack buffer in parse_advertisement_frame, corrupting the return address to hijack control flow and execute code on the device. Public exploit code is available on GitHub (xiaobor123 VxWorks vuln-finding repo), lowering the barrier to weaponization. Per the CVSS vector this requires some privilege level (PR:L), though the description does not confirm the exact authentication prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Stack-based buffer overflow in the devdiscover service of the FAST FAC1200R router running firmware 5.0_20201119_1.0.2 allows an attacker who can reach the device-discovery endpoint to overwrite stack memory with a crafted advertisement frame, with the assessed impact being full loss of confidentiality, integrity and availability (remote-code-execution class, CWE-121). Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch has been identified at time of analysis. The vendor-supplied CVSS 4.0 vector specifies PR:L, so some level of privilege or authentication is presumed to be required even though the advisory text does not confirm the exact prerequisite, and no CISA KEV entry indicates that this is currently being exploited in the wild.
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted about the disclosure and did not respond, so there is no fixed firmware version to upgrade to and no CVE-linked vendor advisory; the only authoritative references are the VulDB entries at https://vuldb.com/vuln/410905 and https://vuldb.com/cve/CVE-2026-101037. Until a fixed build appears, apply compensating controls that specifically reduce exposure of the devdiscover service: if the firmware exposes a toggle for device discovery or the devdiscover daemon, disable it (trade-off: router setup wizards and app-based onboarding may stop working and must be performed manually); if it cannot be disabled, block the discovery traffic at network boundaries and on untrusted segments so advertisement frames cannot reach the device from attacker-controlled hosts (trade-off: discovery-based features stop working across VLANs or guest networks); and place the router's management and discovery traffic on a dedicated trusted VLAN with firewall rules permitting only known management hosts (trade-off: added administrative complexity and the risk that misconfigured rules lock out legitimate management). Because public exploit code exists, monitor device logs for abnormally large or malformed discovery frames and plan hardware replacement if the vendor remains unresponsive, since an unpatched, remotely triggerable memory-corruption bug in a production router cannot be mitigated by configuration alone with full confidence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow in parse_advertisement_frame, a routine inside the router's devdiscover service that handles device-discovery advertisement frames. Discovery protocols of this type rely on broadcast/multicast frames exchanged between LAN peers, and the affected firmware (CPE cpe:2.3:a:fast:fac1200r:*:*:*:*:*:*:*:*) does not bound the length of attacker-supplied data before copying it into a fixed-size stack buffer, so a malformed advertisement frame overwrites adjacent stack memory and can redirect execution. The public proof-of-concept is published in a repository organized under VxWorks-related research material and whose directory name references a copy_msg_element routine, which hints the overflow occurs at a message-element copy operation rather than in parsing logic itself; the advisory itself attributes the defect only to parse_advertisement_frame. Because the vulnerability is remote (AV:N), low complexity (AC:L) and requires no user interaction (UI:N) per the assessed vector, a single crafted frame to a reachable discovery endpoint is sufficient to corrupt memory, and the scope-change components (SC/SI/SA:H) in the vendor CVSS 4.0 score reflect the likelihood that the compromised component can affect the wider device.
Know when Fac1200R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable discovery service with vendor-asserted PR:L and no user interaction; stack overflow yields full device RCE (C/I/A:H); scope unchanged as compromise stays on the single device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
CWE-121, stack-based buffer overflow in the devdiscover service of the FAST FAC1200R firmware.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The FAST FAC1200R router running firmware 5.0_20201119_1.0.2 contains a high-severity stack-based buffer overflow in its devdiscover service, allowing an authenticated attacker to achieve remote code execution and fully compromise confidentiality, integrity, and availability. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis. Organizations using these routers in edge or branch networks should treat this as a priority risk due to the potential for data exfiltration, network disruption, and lateral movement.
Restrict network access to the device-discovery endpoint to trusted internal networks only; segment affected routers from critical assets; monitor for exploitation attempts (e.g., unusual traffic to devdiscover service); consider replacing affected devices if vendor remains unresponsive.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB