Medium severity · published Sep 23, 2026
CVE-2026-96676
Fast FAC1900R uhttpd get_alias_name stack-based overflow
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FAC1900R · Fast
20190827_2.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96676
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96676
github.com
https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1900R-devDiscoverNotify
vuldb.com
https://vuldb.com/cve/CVE-2026-96676
vuldb.com
https://vuldb.com/submit/902770
vuldb.com
https://vuldb.com/vuln/408999
vuldb.com
https://vuldb.com/vuln/408999/cti
More from FAC1900R
10.0
CVE-2026-101039
FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow
