CVE-2026-101039 in FAC1900R
Summary
by MITRE • 09/28/2026
A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The FAST FAC1900R device, specifically version 20190827_2.0.2, contains a critical security flaw within its devdiscover Service component that poses significant risks to network infrastructure integrity. The vulnerability resides in the copy_msg_element function, which is responsible for handling message data during discovery processes. This specific implementation error results in a stack-based buffer overflow, a classic memory corruption issue where more data is written to a fixed-length stack-allocated buffer than it can hold. When this condition occurs, the excess data overwrites adjacent memory locations on the call stack, potentially corrupting critical control structures such as return addresses and saved frame pointers. This type of flaw falls squarely under CWE-121, which defines stack-based buffer overflow vulnerabilities that allow attackers to manipulate program execution flow by overwriting these crucial memory segments.
The operational impact of this vulnerability is severe due to its remote exploitability. An attacker does not need physical access or local authentication privileges on the target system; instead, they can trigger the flaw from a distant network location by sending specially crafted packets that invoke the vulnerable function with oversized input parameters. Because the devdiscover Service likely handles incoming discovery requests common in industrial and enterprise networks, this attack vector is particularly dangerous as it targets services often exposed to broader network segments or even the internet depending on firewall configurations. The successful exploitation of this stack-based buffer overflow typically leads to arbitrary code execution, allowing an attacker to gain full control over the affected device. This could result in unauthorized access to sensitive operational data, disruption of industrial processes if deployed in SCADA environments, or use of the compromised device as a pivot point for further lateral movement within the network.
Compounding the severity of this issue is the availability of public exploit code and the vendor's lack of response to disclosure efforts. The fact that an exploit is publicly available significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated attacks or opportunistic exploitation by individuals with limited technical expertise. Furthermore, the absence of a patch from FAST FAC1900R leaves administrators without official remediation options through standard update mechanisms. This situation aligns with ATT&CK technique T1203, which covers Exploitation for Client Execution, as well as potential lateral movement techniques if the device is integrated into larger network architectures. The lack of vendor support also implies that any mitigation must be implemented externally by system administrators rather than through official firmware updates.
To mitigate this risk in the absence of a vendor patch, organizations should implement strict network segmentation to isolate devices running affected versions from untrusted networks and restrict access to the devdiscover Service ports using firewall rules or Access Control Lists. Deep packet inspection solutions can also be configured to detect anomalous traffic patterns indicative of buffer overflow attempts, such as unusually large payloads directed at discovery services. Additionally, enabling logging on relevant network segments allows for monitoring and alerting on potential exploitation attempts. Since the vulnerability is remote exploitable, ensuring that no direct internet-facing exposure exists for this service is paramount until a secure firmware version becomes available or alternative hardware replacements are procured. Continuous vigilance and proactive defense-in-depth strategies are essential to protect against both known exploits leveraging this specific flaw and similar vulnerabilities in adjacent systems.