FastNetMon Community Edition up to 1.2.9 gRPC API src/fastnetmon.cpp InsecureServerCredentials denial of service

Summaryinfo

A vulnerability, which was classified as problematic, has been found in FastNetMon Community Edition up to 1.2.9. Impacted is the function grpc::InsecureServerCredentials of the file src/fastnetmon.cpp of the component gRPC API. Performing a manipulation results in denial of service. This vulnerability is reported as CVE-2026-48692. The attacker must have access to the local network to execute the attack. No exploit exists.

Detailsinfo

A vulnerability was found in FastNetMon Community Edition up to 1.2.9. It has been classified as problematic. This affects the function grpc::InsecureServerCredentials of the file src/fastnetmon.cpp of the component gRPC API. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-48692 since 05/22/2026. The exploitability is told to be easy. The attack can only be done within the local network. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31845). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• FastNetMon

Name

• Community Edition

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion