CVE-2026-96257 in FAC1203R Gigabit Edition
Summary
by MITRE • 09/23/2026
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The Fast FAC1203R Gigabit Edition 2.0.4 network device contains a critical security vulnerability within its Device Discovery Service component, specifically affecting the copy_msg_element function. This flaw represents a stack-based buffer overflow condition that arises when the application fails to properly validate or bound-check input data before copying it into a fixed-size memory buffer on the call stack. In C and similar low-level programming languages, such errors occur when more data is written to a buffer than it can hold, causing adjacent memory locations to be overwritten with unintended values. This specific implementation error allows an attacker who sends a specially crafted packet or message sequence to exceed the allocated stack space, thereby corrupting critical control data such as return addresses and saved frame pointers stored on the same stack segment.
From an operational perspective, this vulnerability is particularly severe because it can be exploited remotely without requiring any form of authentication or prior access to the network device. The Device Discovery Service typically listens for broadcast or multicast packets used by network management tools to identify connected devices, making it a common entry point for automated attacks across local area networks and potentially wider internet-facing interfaces if exposed. Since an exploit has already been published in public repositories, threat actors can readily utilize existing proof-of-concept code to target vulnerable systems. The ability to execute arbitrary code remotely via stack corruption means that successful exploitation could lead to complete system compromise, allowing the attacker to gain root or administrator-level privileges on the device. This level of access enables malicious activities such as intercepting network traffic, pivoting to other internal assets, installing persistent backdoors, or disrupting critical network infrastructure services.
The security implications align closely with Common Weakness Enumeration identifier CWE-120, which classifies buffer copies without checks of overflow size, and CWE-787, which denotes out-of-bounds write access. Furthermore, the attack vector corresponds to MITRE ATT&CK technique T1190, Exploit Public-Facing Application, as well as potential lateral movement techniques if the device is used as a pivot point within an enterprise network. The lack of vendor response despite early notification exacerbates the risk profile for organizations still operating this firmware version, leaving them without official patches or guidance on mitigation strategies from the manufacturer.
To mitigate these risks in environments where immediate patching may not be feasible due to the vendor's non-response, administrators should implement strict network segmentation policies to isolate vulnerable devices from untrusted networks and restrict access to the Device Discovery Service ports using firewall rules that limit source IP addresses to known management stations only. Additionally, deploying intrusion detection or prevention systems with signatures capable of detecting stack-based overflow attempts can provide a layer of defense against active exploitation attempts. Organizations should also conduct an inventory audit to identify all instances of this hardware and firmware combination and prioritize their replacement or upgrade once the vendor issues a security update, while simultaneously monitoring for any signs of compromise such as unusual network traffic patterns or unauthorized configuration changes on these devices.