External risk intelligence

FAST FAC1200R Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-50402

The device is a network appliance/router (FAC1200R). Such devices are commonly deployed as internet-facing gateways or edge services. Because the vulnerability involves a parameter often found in administrative or authentication interfaces, it is likely to be reachable from the internet in standard deployment configurations.

Buffer Overflow

Fastcom Fac1200r Firmware

f400_fac1200r_q

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in FAST FAC1200R devices, specifically related to a buffer overflow issue exploitable through the `fac_password` parameter. This type of flaw can allow unauthorized individuals to potentially disrupt device operations or gain control. The primary concern is confirming if these devices are deployed within the organization and if they are exposed in a manner that could be targeted.

Password handling flaw allows potential system compromise.
Critical remote exploitation risk for network devices.
Confirm device presence and exposure to assess impact.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by interacting with the device over the network. If the attacker sends a specially crafted string as the `fac_password` parameter to the `sub_80435780` function, they can trigger a buffer overflow. This overflow could potentially lead to a complete compromise of the device.

Network access is required.
Specially crafted password parameter triggers overflow.
Complete device compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to cause a denial of service or potentially execute arbitrary code by sending a specially crafted string as the `fac_password` parameter to the affected function. This could disrupt the normal operation of the device or compromise its integrity when supported by the advisory.

System availability and integrity.
Network access via the `fac_password` parameter.
Service disruption or unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Understanding ownership and immediate actions for this vulnerability requires coordination between the team managing the FAST FAC1200R devices, likely an infrastructure or network team, and potentially a vendor management team if the device is supported by a third party. The first practical step is to locate all instances of the affected technology, assess their network exposure and criticality, identify the specific device owners, and then prioritize remediation efforts based on risk.

Infrastructure team owns the issue.
Verify device exposure and criticality.
Plan vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FAST FAC1200R device?

The FAST FAC1200R is a networking appliance used as a router or gateway to manage data traffic. It runs specialized firmware (specifically version F400_FAC1200R_Q) to handle administrative tasks, network routing, and device authentication.

What does this buffer overflow mean for CVE-2025-50402?

This vulnerability is classified as CWE-120, which is a classic buffer overflow. It happens when the software tries to store more data in a memory space than it is designed to hold. In this case, providing a specifically crafted, overly long string to the 'fac_password' parameter overwrites adjacent memory, potentially causing the device to crash or allowing unauthorized commands to run.

How is this vulnerability triggered?

An attacker triggers the flaw by sending a maliciously crafted string to the 'fac_password' parameter during the device's authentication process. It is important to note that the issue resides in the processing of this specific input field; standard, legitimate password entries used during normal operation will not trigger this overflow.

Why should I care about my exposure?

According to Halo Surface Signal, the FAC1200R is typically deployed as an internet-facing gateway, making it highly accessible to external network traffic. Because the vulnerability does not require prior authentication to exploit, any device reachable from the public internet is at a significantly higher risk of compromise compared to devices kept strictly on an internal, isolated network.

What should I do if I use these devices?

Your first step is to inventory your network to confirm if you are running the affected firmware version. Once identified, work with your infrastructure or network team to assess how these devices are positioned and whether they are exposed to the public internet. Prioritize these units for remediation, such as restricting access or applying vendor updates, to mitigate the risk of unauthorized access.

References

github.com/sezangel/IOT-vul/tree/main/FAST/FAC1200R/2

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.