CVE-2026-101038 is a critical (CVSS 9.9) stack-based buffer overflow in the FAST FAC1200R router, firmware 5.0_20201119_1.0.2, in a parser called MmtAtePrase. The record says the vendor did not respond to disclosure. No fixed version is listed, so isolate or replace the device and check for any vendor notice.
What's affected
The record names FAST FAC1200R firmware 5.0_20201119_1.0.2 and the MmtAtePrase parser component. No other versions are mentioned.
The record states that the vendor was contacted early about the disclosure but did not respond. No fixed version appears in the record. Do not assume a patch exists.
How to check if you're exposed
There is no package manager entry for this, so check the device itself.
- Search your inventory for the FAST FAC1200R. The record names firmware 5.0_20201119_1.0.2.
- Confirm the model and firmware from the label or the admin page.
- Check whether the management interface can be reached from the internet or from untrusted networks, for example with a scan of your own public address space.
What to do now
- Do not expose the device's web management interface to the internet. Restrict it to a trusted management network.
- If the device is internet facing today, take it off until you have a plan. There is no vendor fix to apply.
- Plan a replacement with a supported model, and set a date.
- Put the device in its own network segment so a compromise cannot reach internal systems.
- Watch the record and the vendor's site for a firmware release, and check any advisory before you trust it.
Why it matters
A stack-based overflow, filed as CWE-119 and its stack variant CWE-121, means input that is longer than the buffer meant for it overwrites memory next to it. On network devices that is often a crash, and sometimes more than that.
The score of 9.9 comes from a network attack vector, low complexity, low privileges and a changed scope, with high impact on all three properties. The record says the exploit is public. It does not report use in the wild, and the KEV flag is false.
Quick check
Is a patch available?
The record lists none and says the vendor did not respond. Check the vendor's site for firmware notes, and plan on isolation or replacement.
Sources
Last reviewed: 19 October 2026.
