Stack-Based Buffer Overflow in Fast FAC1203R Gigabit Edition

A critical security vulnerability (CVE-2026-96257) has been identified in the Fast FAC1203R Gigabit Edition firmware version 2.0.4. The vulnerability originates in the copy_msg_element function within the Device Discovery Service. Due to improper input validation, an attacker can trigger a stack-based buffer overflow by sending a specially crafted packet to the device. Because the service is exposed and reachable remotely, this flaw allows for unauthenticated remote code execution with the privileges of the service. Publicly available exploit code exists, increasing the risk of active exploitation. The vendor has not responded to disclosure attempts, and no security patches are currently available.

Impact

Successful exploitation results in full system compromise, allowing an attacker to execute arbitrary code with elevated privileges on the network device. This facilitates deeper lateral movement into the local network, traffic interception, and potential persistence within the infrastructure. This vulnerability is rated with a CVSS v3.1 base score of 10.0, indicating the highest level of severity.

Recommendation

1. Restrict network access to the Device Discovery Service on all Fast FAC1203R units to trusted management segments only.
2. Implement network-level egress and ingress filtering to identify anomalous packet structures targeting common device discovery ports.
3. Monitor device logs for signs of service crashes or unauthorized configuration changes, which may indicate attempted exploitation of CVE-2026-96257.
4. Isolate vulnerable hardware from the public internet until a firmware update is provided by the vendor.