CVE-2026-101354 in FAC1203R
Summary
by MITRE • 09/29/2026
A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in FAST FAC1203R firmware version 20200116_2.0.4 represents a critical security risk rooted in improper memory management within the device's network processing stack. Specifically, the flaw resides in the _tWlanTask function of the MmtAtePrase Parser component. This parser is responsible for handling incoming data packets or configuration commands over the wireless interface. The core technical defect is a stack-based buffer overflow, which occurs when the application writes more data to a fixed-length buffer on the call stack than it can hold. This typically happens due to insufficient bounds checking during the parsing of input strings or network payloads. When an attacker sends a specially crafted packet designed to exceed the allocated buffer size, the excess data overwrites adjacent memory locations on the stack. In many embedded systems and router architectures, this overflow can corrupt critical return addresses or function pointers stored on the stack frame.
From an operational perspective, the exploitation of this vulnerability allows for arbitrary code execution with the privileges of the affected process. Since the vulnerable component is part of the WLAN task, it likely runs with elevated system permissions to manage network interfaces and hardware registers. Successful exploitation enables a remote attacker to execute malicious commands on the device's operating system. This can lead to full compromise of the router, allowing the attacker to intercept traffic, install persistent backdoors, or use the compromised device as part of a botnet for distributed denial-of-service attacks. The requirement for local network access means that an attacker must be within wireless range of the target device and authenticated or able to send unauthenticated packets depending on specific configuration settings. However, given that many IoT devices have open management interfaces or weak default credentials, this barrier is often easily bypassed in real-world scenarios.
The public release of exploit code significantly escalates the threat landscape associated with this vulnerability. Once exploits are available publicly, they can be automated by malicious actors to scan and compromise vulnerable devices at scale without requiring specialized knowledge. This transforms a theoretical flaw into an immediate operational risk for any organization or individual deploying these specific firmware versions. The lack of response from the vendor further exacerbates the situation, leaving users with no official patch or mitigation guidance. In such cases, reliance on community-driven fixes or manual configuration changes becomes necessary to reduce exposure until a patched version is released by the manufacturer.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-121: Stack-based Buffer Overflow and CWE-787: Out-of-bounds Write. These classifications highlight the fundamental failure in input validation and memory safety practices during software development. From a tactical standpoint, this flaw facilitates techniques described in the MITRE ATT&CK framework, particularly Remote Code Execution (T1059) and potentially Command and Scripting Interpreter abuse if the attacker gains shell access. The ability to execute code remotely via network interaction places it within the initial access or execution tactics depending on whether privilege escalation is required post-exploitation.
Mitigation strategies for this vulnerability are constrained by the vendor's non-responsiveness but remain critical for risk reduction. Users should immediately assess if their devices are running the affected firmware version 20200116_2.0.4 and prioritize updating to a patched version as soon as it becomes available from alternative sources or future releases. In the interim, network segmentation is highly recommended; placing these IoT devices in isolated VLANs prevents lateral movement if one device is compromised. Additionally, disabling remote management features and restricting administrative access to trusted IP addresses can reduce the attack surface. Implementing strict ingress filtering on firewalls to block malformed packets that trigger buffer overflows may also provide a layer of defense-in-depth against automated exploitation attempts.