Cyber Posture

CVE-2025-50402

CriticalPublic PoC

Published: 26 November 2025

Published
26 November 2025
Modified
02 January 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-50402 is a buffer overflow vulnerability (CWE-120) affecting the FAST FAC1200R F400_FAC1200R_Q firmware or component. The issue resides in the function sub_80435780, which can be triggered via a specially crafted value in the fac_password parameter. Published on 2025-11-26 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it represents a critical remote code execution risk in this IoT device firmware.

An unauthenticated attacker with network access can exploit this vulnerability by sending a malicious fac_password string to the affected component, leading to a buffer overflow. Successful exploitation allows arbitrary code execution with high impact on confidentiality, integrity, and availability, potentially resulting in full device compromise, such as router takeover for further network pivoting or data exfiltration.

References point to a GitHub repository (https://github.com/sezangel/IOT-vul/tree/main/FAST/FAC1200R/2) containing vulnerability details or proof-of-concept code for the FAST FAC1200R, but no official advisories or patches are detailed in available information. Security practitioners should isolate affected devices and monitor for firmware updates from the vendor.

Details

CWE(s)
CWE-120

Affected Products

fastcom
fac1200r firmware
f400_fac1200r_q

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a critical unauthenticated buffer overflow in router firmware exploitable over the network via a crafted parameter, directly enabling remote code execution through exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References