Critical severity · published Sep 28, 2026
CVE-2026-101037
FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow
9.9
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FAC1200R · FAST
5.0_20201119_1.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101037
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101037
vdb-entry
https://vuldb.com/vuln/410905
signature
https://vuldb.com/vuln/410905/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101037
third-party-advisory
https://vuldb.com/submit/927154
exploit
https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1200R-copy_msg_element/vul-find-FAST_FAC1200R-copy_msg_element
More from FAC1200R
9.9
CVE-2026-101038
FAST FAC1200R MmtAtePrase stack-based overflow