# CVE-2026-96676: Fast FAC1900R stack-based buffer overflow in uhttpd

Source: https://junglewise.ai/threats/cve-2026-96676-a-vulnerability-was-identified-in-fast-fac1900r-20190827-2-0-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96676 · Severity: medium · CVSS 6.3 · Published 2026-09-23

The Fast FAC1900R router contains a stack-based buffer overflow in its web management service (uhttpd). An attacker can send a specially crafted HTTP request to trigger the vulnerability, causing the router service to crash or potentially allowing execution of malicious code. Since the vulnerable service is exposed on the network, the vulnerability can be exploited remotely without authentication.

Vendors: [Fast](https://junglewise.ai/threats/vendors/fast).

## Quick answers

**Is CVE-2026-96676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96676 being exploited in the wild.

**How severe is CVE-2026-96676?** Medium severity, with a CVSS score of 6.3, published 23 September 2026.

**Which products and versions are affected?** Fast FAC1900R 20190827_2.0.2.

**Is there a fix for CVE-2026-96676?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96676 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-96676?** Check whether you run Fast FAC1900R at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the get_alias_name function within uhttpd (at offset 0x4049C9A8) that fails to validate the length of the cloud_config.info.alias field before copying it via memcpy into a ~64-byte stack buffer. The vulnerability is reachable via HTTP POST requests to TCP port 10080 through the httpProcDataSrv → cloudMsgSetAliasHandle call chain. An unauthenticated remote attacker can send a JSON request with an alias field exceeding 64 bytes (up to Content-Length limits) to overwrite the function return address on the stack, causing service crash or potential code execution.

## Affected products

- Fast FAC1900R 20190827_2.0.2

## Timeline

- 2026-09-23: disclosed: Vulnerability disclosed; public exploit code available
- 2026-09-23: other: Vendor was contacted early about disclosure but did not respond

## References

- [https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1900R-devDiscoverNotify](https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1900R-devDiscoverNotify)
- [https://vuldb.com/cve/CVE-2026-96676](https://vuldb.com/cve/CVE-2026-96676)

## Related threats

- [FAST FAC1900R stack buffer overflow in devdiscover service](https://junglewise.ai/threats/cve-2026-101039-a-vulnerability-was-identified-in-fast-fac1900r-20190827-2-0-2)