The vulnerability in FastNetMon Community Edition (≤1.2.9) stems from the execute_web_request_secure() function failing to call set_verify_mode(boost::asio::ssl::verify_peer) on the TLS client context. Although CA certificates are loaded via set_default_verify_paths(), the lack of explicit peer verification means OpenSSL does not validate the server's certificate chain. Consequently, HTTPS connections used for telemetry data transmission can be intercepted or redirected by attackers, compromising confidentiality and integrity of system telemetry data such as CPU model, kernel version, traffic statistics, and software configuration.

An attacker capable of performing man-in-the-middle attacks on outbound HTTPS connections can intercept or alter telemetry data sent by FastNetMon to community-stats.fastnetmon.com. This exposure leads to loss of confidentiality and integrity of system information. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling telemetry reporting or restricting network access to community-stats.fastnetmon.com to trusted environments to reduce exposure to man-in-the-middle attacks.