External risk intelligence

FAST FAC1200R Buffer Overflow Vulnerability in Password Parameter

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-50399

The affected product is an IoT device, specifically a router/gateway. Such devices are commonly deployed at the network edge and often feature administrative interfaces that are reachable from the network, making them likely to be exposed to the internet in common deployment scenarios.

Buffer Overflow

Fastcom Fac1200r Firmware

f400_fac1200r_q

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in FAST FAC1200R routers, specifically within the firmware version F400_FAC1200R_Q. The issue, a buffer overflow, could allow an unauthenticated attacker to remotely compromise the device's functions. Given the nature of these devices as network edge components, understanding their exposure and potential impact is crucial.

Unauthenticated remote takeover risk for network devices.
IoT devices are common targets for network compromise.
Confirm relevance and assess exposure to connected systems.

Attack Path

How an attacker could exploit the issue

An attacker could target a router from the internet, sending specially crafted data to a specific function. This could lead to code execution with high privileges.

No authentication needed.
Vulnerable function parameter.
High impact to confidentiality, integrity, and availability.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability in the password parameter of the FAC1200R F400_FAC1200R_Q firmware could allow an unauthenticated attacker to overwrite memory and potentially execute arbitrary code. This could affect the integrity and availability of the device's functions.

Device configuration and memory could be affected.
Attackers could exploit it via the network.
Potential for device compromise and disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this critical buffer overflow vulnerability in FAST FAC1200R F400_FAC1200R_Q firmware likely falls to the infrastructure or network security team responsible for managing edge devices and network appliances. The first practical step involves identifying all instances of this device, confirming their network reachability and business criticality, and then coordinating with the vendor for a resolution or implementing temporary risk reduction measures.

Infrastructure and Network Security teams.
Verify device reachability and criticality.
Coordinate vendor remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FAST FAC1200R?

The FAST FAC1200R is a router or gateway device produced by Fastcom. These devices serve as network edge components, managing traffic and connectivity between local networks and the internet. Because they act as the entry point for data, they are foundational to maintaining network communication.

What does this buffer overflow vulnerability mean?

This vulnerability is classified as CWE-120. A buffer overflow occurs when a program writes more data to a memory buffer than it can hold, causing it to overwrite adjacent memory. In this case, providing unexpected input to the 'password' parameter allows the device to overwrite its own memory, which can lead to unauthorized code execution and complete loss of control over the router's functions.

How can an attacker trigger this vulnerability?

An attacker triggers this issue by sending specially crafted data through the network directly to the vulnerable 'password' parameter. Crucially, the system does not require any login credentials to process this data. If the input is kept within standard, expected parameters, the buffer remains stable and the device functions normally; only malicious, oversized data triggers the overflow.

Is my device at risk based on Halo Surface Signal?

Yes, Halo Surface Signal flags this as 'Likely' to be exposed. Because this device is an IoT router or gateway, it is frequently deployed at the network edge, often making its management interfaces reachable from the internet. If your device is accessible beyond your internal network, it is effectively exposed to remote, unauthenticated actors.

What should I do to secure my network?

Start by performing an inventory to locate every instance of the FAC1200R within your network infrastructure. Verify whether these devices are currently reachable from the internet. Once mapped, coordinate with your vendor to determine if a firmware update is available for your specific model and monitor their official channels for guidance on risk reduction measures.

References

github.com/sezangel/IOT-vul/tree/main/FAST/FAC1200R/1

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.