CVE-2026-96676: Fast FAC1900R Buffer Overflow Vulnerability

CVE-2026-96676 Overview

CVE-2026-96676 is a stack-based buffer overflow in the Fast FAC1900R router running firmware version 20190827_2.0.2. The vulnerability resides in the get_alias_name function of the uhttpd web server component. An attacker can trigger the overflow remotely by supplying crafted input to the affected function. Public exploit code exists, increasing the likelihood of opportunistic use against exposed devices. The vendor was contacted before public disclosure but did not respond. The flaw is categorized under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Remote attackers with low-level privileges can corrupt stack memory in uhttpd, potentially disrupting the web management interface or influencing execution flow on the router.

Affected Products

Fast FAC1900R router
Firmware version 20190827_2.0.2
uhttpd web server component (function get_alias_name)

Discovery Timeline

2026-09-23 - CVE-2026-96676 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96676

Vulnerability Analysis

The vulnerability affects the get_alias_name function inside the uhttpd binary of the Fast FAC1900R router. uhttpd is a lightweight HTTP daemon commonly used on embedded Linux and OpenWrt-derived firmware to expose the router's management interface. When attacker-controlled input reaches get_alias_name, the function copies data into a fixed-size stack buffer without adequately validating the input length. This overwrites adjacent stack memory, including saved return addresses and control data. The condition is reachable over the network, which places any exposed management interface within scope.

Root Cause

The root cause is improper bounds checking on data handled by get_alias_name, mapped to CWE-119. The function trusts the length or structure of an alias-related input value and performs a memory copy that exceeds the destination buffer. Embedded router firmware of this vintage rarely enables modern memory protections such as stack canaries, position-independent execution, or non-executable stacks consistently, which amplifies the impact of the overflow.

Attack Vector

Exploitation requires network access to the router's uhttpd interface and low-privilege authentication, based on the CVSS 4.0 vector metrics. An attacker sends a crafted HTTP request that reaches the alias-name handling code path. The oversized payload overflows the stack buffer in get_alias_name. Successful exploitation can crash uhttpd, degrade the management plane, or, depending on protections present in the firmware image, influence execution flow. Public proof-of-concept material is referenced in the GitHub VxWorks Vulnerability Tool repository and the VulDB CVE-2026-96676 entry.

No verified exploit code is reproduced here. Refer to the linked references for technical artifacts.

Detection Methods for CVE-2026-96676

Indicators of Compromise

Unexpected crashes or restarts of the uhttpd process on the router
HTTP requests to the router management interface containing abnormally long alias-related parameters
New or unfamiliar administrative sessions originating from external IP addresses
Configuration changes on the router that do not correlate with authorized administrative activity

Detection Strategies

Inspect inbound HTTP traffic to router management interfaces for oversized query parameters or POST fields associated with alias configuration
Correlate uhttpd service restarts with preceding HTTP request bursts from a single source
Alert on management-interface access from networks that should never reach the router administratively, such as the WAN side

Monitoring Recommendations

Forward router syslog output to a centralized log platform and retain HTTP access logs for correlation
Baseline normal administrative traffic patterns and alert on deviations in request size, frequency, or source
Monitor for connectivity loss and management-plane outages that may indicate exploitation attempts against uhttpd

How to Mitigate CVE-2026-96676

Immediate Actions Required

Restrict access to the router's HTTP management interface to trusted internal networks only and disable remote WAN administration
Change all administrative credentials on affected FAC1900R devices, especially any low-privilege accounts that could reach uhttpd
Inventory affected Fast FAC1900R devices running firmware 20190827_2.0.2 and prioritize network segmentation for those units
Consider replacing end-of-support or unresponsive-vendor devices with actively maintained hardware

Patch Information

No vendor patch is available. According to the CVE description, the vendor was contacted about this disclosure but did not respond. Consult the VulDB CVE-2026-96676 entry and the VulDB vulnerability record #408999 for updates on any future remediation.

Workarounds

Place the router's management interface behind a firewall rule that permits only specific administrative source IPs
Disable HTTP-based remote management and use out-of-band methods for configuration changes where supported
Deploy network-level access control lists to block untrusted networks from reaching uhttpd on the router
Where possible, migrate to firmware or devices with active vendor security support

bash

# Example: restrict router management access to a trusted admin subnet
# (apply on an upstream firewall in front of the FAC1900R)
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP