FastNetMon Community Edition versions up to 1.2.9 expose an unauthenticated gRPC API server on port 50052, initialized with grpc::InsecureServerCredentials(), explicitly allowing connections without authentication. The RPC methods, including ExecuteBan and ExecuteUnBan, perform critical administrative functions such as BGP route announcements that can blackhole traffic and execute external notification scripts via popen(), all without credential checks or role-based access control. An attacker with local network access can exploit this to ban arbitrary IP addresses, unban attacks to disable mitigation, and execute arbitrary scripts, leading to denial of service and potential further compromise.

The vulnerability allows an attacker with local network access to perform unauthorized administrative actions on the FastNetMon server, including banning IP addresses to cause denial of service, unbanning attacks to disable DDoS protections, and executing arbitrary external scripts. This compromises the confidentiality and integrity of network traffic management, potentially disrupting network availability and security. The CVSS score of 8.1 reflects high impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the gRPC API port 50052 to trusted hosts only, and consider deploying network-level controls to prevent unauthorized local network access. Monitor vendor channels for updates or patches addressing this authentication bypass vulnerability.