FastNetMon Community Edition versions through 1.2.9 expose an unauthenticated gRPC API server initialized with grpc::InsecureServerCredentials(), explicitly allowing connections without authentication. RPC methods including ExecuteBan and ExecuteUnBan perform critical administrative actions such as BGP route announcements that can blackhole traffic and execution of external notification scripts via popen(), all without credential verification or role-based access control. An attacker with local network access can exploit this to cause denial of service by banning arbitrary IPs, disable DDoS mitigation by unbanning attacks, and execute arbitrary scripts, leading to potentially severe network disruption and compromise.

An attacker on the local network can perform unauthorized administrative actions on the FastNetMon server, including blackholing legitimate IP traffic and disabling DDoS mitigation. The ability to execute external scripts via the API increases the risk of arbitrary code execution. These actions can cause significant denial of service and compromise network security. No evidence of known exploits in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the FastNetMon gRPC API port 50052 to trusted hosts only and monitor for unauthorized access attempts. Consider deploying network-level controls to prevent untrusted local network users from reaching the API server. Avoid exposing the API server on untrusted networks.