CVE-2026-96676 in FAC1900R
Summary
by MITRE • 09/24/2026
A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within Fast FAC1900R 20190827_2.0.2 represents a critical security flaw located in the uhttpd component, specifically affecting the get_alias_name function. This software is commonly deployed as an embedded web server for routers and network appliances, making it a frequent target for attackers seeking initial access to local networks. The core technical issue stems from improper bounds checking during string manipulation operations within this specific function. When processing user-supplied input that serves as an alias name, the application fails to validate the length of the incoming data against the allocated stack buffer size. This lack of validation allows a malicious actor to supply an excessively long string that exceeds the memory boundaries reserved for local variables on the call stack.
This architectural oversight results in a classic stack-based buffer overflow condition. As the oversized input overwrites adjacent memory locations, it can corrupt critical control data such as return addresses and saved frame pointers stored on the stack. In practical exploitation scenarios, an attacker leverages this memory corruption to redirect program execution flow. By carefully crafting the payload to include shellcode or instructions that invoke system-level commands, the adversary can achieve arbitrary code execution with the privileges of the uhttpd process. Given that embedded web servers often run with elevated permissions necessary for configuration management and network interface control, successful exploitation typically grants the attacker full administrative access to the underlying device.
The operational impact of this vulnerability is severe due to its remote exploitability. Since uhttpd listens on standard HTTP ports accessible over the network, an unauthenticated attacker can trigger the flaw from a remote location without requiring prior authentication or physical proximity to the target hardware. The availability of public exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and widespread compromise across vulnerable devices in the wild. Compromised systems may be used as pivot points for lateral movement within internal networks, launched against other infrastructure components, or integrated into botnets for distributed denial-of-service attacks. Furthermore, because vendor engagement yielded no response regarding patches or updates, organizations relying on this hardware face prolonged exposure to active threats without official remediation guidance from the manufacturer.
From a classification perspective, this flaw aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-787 Out-of-bounds Write in ATT&CK framework contexts related to execution privilege escalation. The remote nature of the attack maps directly to techniques involving web server exploitation where attackers inject malicious payloads into service handlers. Mitigation strategies are currently limited due to the lack of vendor support, necessitating defensive workarounds at the network perimeter. Administrators should restrict access to the management interfaces and HTTP services through strict firewall rules, allowing connections only from trusted IP addresses or isolated administrative networks. Additionally, deploying intrusion detection systems configured with signatures for known uhttpd exploitation attempts can provide an additional layer of monitoring and alerting. If possible, isolating affected devices into separate VLANs prevents potential lateral movement should a compromise occur, thereby containing the blast radius within the broader network infrastructure until hardware replacement or alternative firmware solutions become available.