CVE-2026-96257: Fast FAC1203R Buffer Overflow Vulnerability

CVE-2026-96257 Overview

CVE-2026-96257 is a stack-based buffer overflow in the Fast FAC1203R Gigabit Edition 2.0.4 router. The flaw resides in the copy_msg_element function within the Device Discovery Service component. An unauthenticated remote attacker can trigger the overflow by sending a crafted network message. Successful exploitation can corrupt stack memory and lead to arbitrary code execution or denial of service on the affected device. The vendor was contacted prior to public disclosure but did not respond, and an exploit has been published.

Critical Impact
Unauthenticated remote attackers can corrupt stack memory on FAST FAC1203R routers via the Device Discovery Service, enabling code execution or full device compromise.

Affected Products

Fast FAC1203R Gigabit Edition, firmware version 2.0.4
Device Discovery Service component (copy_msg_element function)
Underlying VxWorks-based router platform per referenced research

Discovery Timeline

2026-09-23 - CVE-2026-96257 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96257

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). It affects the copy_msg_element function inside the Device Discovery Service of the FAST FAC1203R router. The function copies elements from an incoming discovery message into a fixed-size stack buffer without validating the source length against the destination capacity. An attacker on the same network segment, or any network path reachable by the discovery service, can deliver a crafted message that overflows the buffer. The attack requires no authentication and no user interaction, which broadens the pool of viable attackers to anyone who can reach the device on the network.

Root Cause

The root cause is missing bounds validation when copy_msg_element transfers message data into a stack-allocated buffer. Because the destination size is fixed at compile time and the input length is attacker-controlled, oversized inputs overwrite adjacent stack memory. On VxWorks-based embedded targets, this typically corrupts saved return addresses and function pointers, opening a path to control flow hijack.

Attack Vector

Exploitation is performed remotely over the network by sending a specially crafted Device Discovery Service message to the vulnerable router. No credentials, prior access, or user interaction are required. A working exploit has been published in a public repository, increasing the likelihood of opportunistic scanning and exploitation. The EPSS score is 0.584% at the 45.5 percentile, reflecting a measurable and rising probability of exploitation attempts in the near term. Technical details and proof-of-concept material are available in the GitHub VxWorks Vulnerability Finder repository and the VulDB CVE-2026-96257 Entry.

Detection Methods for CVE-2026-96257

Indicators of Compromise

Unexpected reboots, crashes, or watchdog resets on FAST FAC1203R routers running firmware 2.0.4
Oversized or malformed packets directed at the Device Discovery Service port from untrusted network segments
New or unexplained outbound connections from the router to unknown hosts following inbound discovery traffic

Detection Strategies

Deploy network intrusion detection signatures that flag Device Discovery Service messages exceeding expected element lengths
Baseline normal discovery protocol traffic and alert on deviations in packet size, frequency, or source
Correlate router crash telemetry with inbound network events to identify probable exploitation attempts

Monitoring Recommendations

Log and forward router syslog data to a centralized platform for anomaly analysis
Monitor management-plane and LAN-side traffic for repeated malformed discovery packets from a single source
Track firmware version inventory to identify unpatched FAC1203R devices exposed to untrusted networks

How to Mitigate CVE-2026-96257

Immediate Actions Required

Restrict network access to the FAC1203R Device Discovery Service using firewall rules or VLAN segmentation
Block untrusted hosts from reaching the router management and discovery ports at the network perimeter
Inventory all FAC1203R devices running firmware 2.0.4 and prioritize them for isolation and monitoring

Patch Information

No vendor patch is currently available. The vendor was contacted before public disclosure but did not respond, per the VulDB CVE-2026-96257 Entry. Administrators should monitor the vendor for future firmware releases and apply updates as soon as they are published.

Workarounds

Place affected routers on isolated management networks and deny discovery protocol traffic from user or guest segments
Disable the Device Discovery Service on affected devices where the feature is not required for operations
Replace end-of-support or unmaintained FAC1203R units with actively supported hardware if no patch is released

bash

# Example: restrict Device Discovery Service exposure at an upstream firewall
# Replace <device_discovery_port> with the observed service port and adjust for your ACL syntax
iptables -A FORWARD -p udp --dport <device_discovery_port> -s <trusted_mgmt_subnet> -d <router_ip> -j ACCEPT
iptables -A FORWARD -p udp --dport <device_discovery_port> -d <router_ip> -j DROP