Threat Intelligence Database

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packet_parser_ng.cpp, after validating that the packet contains at least sizeof(ipv4_header_t) bytes (20 bytes), the code advances the local_pointer by '4 * ipv4_header->get_ihl()' (line 164) without validating that (a) IHL >= 5 (the minimum valid value per RFC 791), or (b) 4 * IHL bytes are actually available in the packet. The IHL field is 4 bits, allowing values 0-15, so the advance can be 0-60 bytes. An IHL value of 15 with only 20 bytes validated causes a 40-byte over-read. An IHL of 0-4 causes the pointer to not advance past the IP header, resulting in the TCP/UDP header being parsed from IP header data (type confusion). This vulnerability is reachable via any packet capture interface.

FastNetMon Community Edition up to version 1.2.9 contains a critical off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class due to an incorrect bounds check in several methods. This flaw allows writing one byte beyond the allocated heap buffer, which can be triggered by sending crafted network traffic such as NetFlow, sFlow, IPFIX, or BGP messages. Exploitation could lead to arbitrary code execution by corrupting heap metadata. The vulnerability has a CVSS score of 9.8, indicating high severity. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and consider mitigating exposure to untrusted network traffic until a fix is released.

CVE-2026-48696 is a buffer overflow vulnerability affecting FastNetMon Community Edition through version 1.2.9. It is distinct from other vulnerabilities identified as CVE-2026-48686 and CVE-2026-48689. The vulnerability has a CVSS v3.1 base score of 6.2, indicating medium severity, and it does not impact confidentiality or integrity but can cause availability issues. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

FastNetMon Community Edition up to version 1.2.9 contains an OS command injection vulnerability in its MikroTik router integration plugin. The vulnerability arises because the _log() function directly concatenates unsanitized input into an exec() shell command, allowing an attacker who can influence command-line arguments to execute arbitrary shell commands. This vulnerability has a high severity with a CVSS score of 8.1. No official patch or remediation guidance is currently provided by the vendor. The recommended fix is to avoid using exec() with unsanitized input and instead use safer alternatives like file_put_contents() or escapeshellarg().

FastNetMon Community Edition up to version 1.2.9 has a configuration injection vulnerability in its Juniper router integration plugin. The vulnerability arises because the IP address input is directly inserted into Juniper NETCONF set-configuration commands without validation or sanitization. An attacker controlling this input can inject arbitrary Juniper CLI commands, potentially modifying routing tables, firewall filters, user accounts, or other router configurations. This can lead to full compromise of the affected router. The vulnerability has a high severity with a CVSS score of 8.1. No official patch or remediation guidance is currently available.

FastNetMon Community Edition up to version 1.2.9 does not verify TLS certificates on outbound HTTPS connections used for telemetry reporting. This flaw allows man-in-the-middle attackers to intercept or modify sensitive system information sent to community-stats.fastnetmon.com. The vulnerability arises because the TLS client context is not set to verify the server's certificate chain during the handshake. No official patch or remediation guidance is currently available.

FastNetMon Community Edition up to version 1.2.9 contains a local symlink vulnerability due to predictable file paths and insecure file handling in /tmp. The application writes to a statistics file at /tmp/fastnetmon.dat without verifying symlinks and sets file permissions insecurely, allowing a local attacker to overwrite arbitrary files with the privileges of the FastNetMon process user. The vulnerability has a medium severity score of 5.5 and does not have a confirmed patch or official remediation guidance at this time.

FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)' and stores it in a uint8_t field (line 600-605). Since uint8_t can only hold values 0-255, an AS_PATH containing more than 63 ASNs (2 + 64*4 = 258 > 255) causes silent truncation. The truncated length is used for buffer sizing, while the actual data written is the full untruncated amount, resulting in a heap buffer overflow. Similarly, the path_segment_length field at line 621 is also uint8_t, truncating with more than 255 ASNs.

FastNetMon Community Edition up to version 1.2.9 has an integer overflow vulnerability in its packet capture buffer allocation logic. The vulnerability arises because the calculation of the buffer size uses 32-bit unsigned integer arithmetic without overflow checks, leading to a smaller-than-expected buffer allocation when a large number of packets is specified. This causes heap corruption when subsequent writes exceed the allocated buffer. The issue is linked to the ban_details_records_count configuration parameter, which is parsed without overflow validation. The CVSS score is 7.1, indicating high severity, with impacts on confidentiality and integrity but no direct availability impact. No patch or official remediation is currently documented, and no known exploits are reported in the wild.

FastNetMon Community Edition through version 1.2.9 includes a gRPC API server on port 50052 that lacks any authentication or access control. This allows an attacker with local network access to invoke administrative RPC methods such as ExecuteBan and ExecuteUnBan, which can disrupt network traffic by blackholing IP addresses or disabling DDoS mitigation. The API also permits execution of external scripts without credential verification. There is no role-based access control to separate monitoring from destructive actions. This vulnerability has a high severity score of 8.1 and poses a significant risk of unauthorized network disruption and command execution.