EUVD-2026-88207
GHSA-49h3-g5vf-r66w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router mgmt interface
-
DeliverySend crafted input to MmtAtePrase parser
-
ExploitOverflow stack buffer in twlantask
-
ExecutionHijack control flow
-
ImpactExecute arbitrary code on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (PR:L) to the FAST FAC1200R management interface to reach the MmtAtePrase parser in the twlantask component; no user interaction is needed once authenticated. Exploitation is network-reachable (AV:N) but bounded by the need for valid credentials and by the router's typically LAN-only management exposure - WAN-side exploitation depends on non-default remote-management configuration. The narrow affected build (firmware 5.0_20201119_1.0.2) and the small deployment base of this TP-Link sub-brand device further limit realistic exposure. |
| Impact | This is a genuine memory-corruption flaw (CWE-121 stack-based buffer overflow) in the MmtAtePrase parser of the FAST FAC1200R router, but the real-world risk is moderate-to-low despite the 8.6 vendor score. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H plus SC:H/SI:H/SA:H) claims full compromise of both the vulnerable and subsequent systems; the subsequent-system (SC/SI/SA:H) metrics appear scope-inflated - a router firmware overflow compromises the device itself, not a distinct downstream system, so the subsequent-system impact is overstated. Critically, PR:L means exploitation requires authentication, which meaningfully limits mass exploitation. A public POC exists (GitHub xiaobor123/vuls-find-VxWorks), matching CVSS E:P (Proof-of-Concept), but there is no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation - POC availability is not the same as in-the-wild use. The dominant risk-limiting factors are the authentication requirement and the product's small deployment footprint (a niche Chinese/TP-Link sub-brand SOHO router). Net: a real, patchable-in-principle bug with a working POC, but low priority absent broader exposure signals, and the vendor did not respond to disclosure so no fix is confirmed available. |
| Exploit ScenarioDerived | An attacker who has authenticated to the router's management interface (e.g., via default or weak credentials on a device exposed to the LAN or, if misconfigured, the WAN) sends crafted input to the twlantask MmtAtePrase parser, overflowing a stack buffer. A publicly disclosed proof-of-concept exists, lowering the barrier to reproduction and enabling arbitrary code execution on the router with the privileges of the VxWorks task. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 28, 2026
Stack-based buffer overflow in the MmtAtePrase parser of the twlantask component on FAST FAC1200R routers running firmware 5.0_20201119_1.0.2 allows an attacker who already holds valid credentials for the device management interface to send crafted input that overwrites stack memory, with the potential for arbitrary code execution or device crash/reboot. Exploitation is network-reachable but gated by authentication (CVSS PR:L) and by the fact that this router's management interface is normally LAN-only, so WAN-side attacks depend on non-default remote-management configuration. A publicly available exploit exists (published proof-of-concept code referencing the twlantask MmtAtePrase overflow), and the vendor was contacted but did not respond, so no vendor patch is available; the flaw is not known to be actively exploited in the wild. The vendor score of 8.6 overstates real-world risk given the narrow affected build, the sub-brand's limited deployment base, and the authentication prerequisite.
Earlier versions of this analysis (1)
Authenticated remote attackers can trigger a stack-based buffer overflow in the MmtAtePrase parser of the FAST FAC1200R router running firmware 5.0_20201119_1.0.2, gaining full compromise of confidentiality, integrity and availability on the device. Publicly available exploit code exists (a published GitHub proof-of-concept), although there is no KEV listing indicating confirmed active exploitation, and the vendor did not respond to disclosure, so no patched firmware is available and every affected device remains exposed once an attacker meets the prerequisite. Exploitation requires a valid, low-privileged session (CVSS 4.0 PR:L, UI:N) and network reachability to the twlantask service that invokes the affected parser - typically the LAN side of the router unless remote management is explicitly enabled on the WAN interface.
RemediationAI
No vendor-released patch was identified at the time of analysis: the vendor was contacted about the disclosure and did not respond, and no fixed firmware version for the FAC1200R is referenced in any advisory. Because exploitation requires valid credentials (PR:L), the highest-value compensating control is to eliminate the authentication path: change any default administrative credentials, enforce a long unique admin password, and avoid sharing the management login. Disable WAN-side/remote management so the interface is reachable only from the local LAN, and place the router behind a segmented network where untrusted clients cannot reach its web management port; the trade-off is loss of remote administration convenience. Do not expose the management interface to the internet via port forwarding or UPnP, and restrict access to trusted management hosts via source-address filtering or a management VLAN if the firmware supports it. Where the device is used only as an access point, disabling the wireless/twlantask functionality if configurable reduces the attack surface, but note that this sacrifices Wi-Fi service and may not fully remove the parser from the firmware. Continuous monitoring of device logs for crashes, reboots, or anomalous management requests can provide early warning, since the overflow may manifest first as instability. Given the 2020-era firmware and the vendor's non-response, plan replacement of the FAC1200R with a currently supported router as the durable fix, and consult the VulDB entries (https://vuldb.com/vuln/410906 and https://vuldb.com/vuln/410906/cti) for any later update on vendor remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-121 stack-based buffer overflow: the MmtAtePrase parsing routine inside the device's twlantask (wireless LAN task) component copies attacker-supplied data into a fixed-size stack buffer without validating length, allowing an overlong field to overwrite adjacent stack memory including saved return addresses. The exploit repository naming (vuls-find-VxWorks) indicates the FAC1200R runs VxWorks, where such overflows can pivot to control-flow hijacking of the task; because the vulnerable code lives in a network-facing parsing path reached through the management interface, the issue is remotely triggerable once an attacker is authenticated. The CPE string cpe:2.3:a:fast:fac1200r:*:*:*:*:*:*:*:* marks the product broadly, but the reported and assessed affected target is specifically firmware build 5.0_20201119_1.0.2. CVSS 4.0 rates this 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity, and availability impact across the vulnerable system and subsequent systems); the independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, agreeing on network reachability, low attack complexity, no user interaction, and the need for low-privileged authenticated access.
Know when Fac1200R gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable parser reached only after authentication (PR:L); stack overflow yields code execution on the device with no scope change to a separate system, so S:U and C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Technical POC Analysis
The bug is a classic CWE-121 stack-based buffer overflow in the MmtAtePrase parser, reached from the firmware's twlantask service on UDP port 1060.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
FAST FAC1200R routers running firmware 5.0_20201119_1.0.2 carry a management-interface vulnerability that can let someone with valid credentials take over or disrupt the device; publicly available exploit code exists and no vendor-released patch is available. Practical exposure is limited because the interface is normally LAN-only and requires authentication, so the main concern is for organizations that have enabled remote management or allowed credential reuse on these devices. Leadership should prioritize inventory and isolation of affected units, especially where they provide remote or edge connectivity.
No vendor-released patch identified; restrict management access to trusted LAN/VLAN, disable WAN/remote management, segment affected routers, enforce strong unique credentials, monitor authentication logs and unexpected device reboots/crashes, and plan replacement or migration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB