FastNetMon Community Edition through version 1.2.9 contains a vulnerability in its TLS client implementation for outbound HTTPS connections. Specifically, the execute_web_request_secure() function creates an SSL context with tls_client mode and loads CA certificates via set_default_verify_paths(), but it does not call set_verify_mode(boost::asio::ssl::verify_peer). As a result, OpenSSL performs the TLS handshake without validating the server's certificate chain. This flaw affects telemetry reporting to community-stats.fastnetmon.com, potentially allowing an attacker to intercept or alter sensitive system telemetry data.

An attacker capable of intercepting outbound HTTPS connections from the affected FastNetMon client can perform man-in-the-middle attacks, leading to interception, modification, or redirection of telemetry data. This could result in the disclosure of system information such as CPU model, kernel version, traffic statistics, and software configuration. There is no indication of direct impact on core network traffic monitoring functionality or broader system compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to telemetry endpoints or disabling telemetry reporting if feasible to prevent exposure of sensitive data. Monitor vendor channels for updates addressing this TLS verification issue.