← Vulnerability feed

Vulnerability record · CVE-2026-48692 · published 26 May 2026

CVE-2026-48692: Pavel-odintsov fastnetmon missing authentication for critical function vulnerability

Pavel Odintsov · Fastnetmon

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

8.1 CVSS 3.1 High EPSS 0.38% · top 71.2% CWE-306 · Missing authentication for critical function
8.1CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
24 Jul 2026Last modified by NVD

Description

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pavel-odintsov/fastnetmon Product
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/api.cpp Product
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp Product
https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-auth Third Party Advisory

Track CVE-2026-48692 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-48689Pavel-odintsov fastnetmon out-of-bounds write vulnerabilityFastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary…EPSS 0.91%9.8CVE-2026-48691Pavel-odintsov fastnetmon integer overflow vulnerabilityFastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4Unicas…EPSS 0.57%9.8CVE-2026-48686Pavel-odintsov fastnetmon classic buffer overflow vulnerabilityFastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. T…EPSS 0.86%9.8CVE-2026-48687Pavel-odintsov fastnetmon os command injection vulnerabilityFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() functi…EPSS 2.7%8.1CVE-2026-48694Pavel-odintsov fastnetmon command injection vulnerabilityFastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_…EPSS 0.41%8.1CVE-2026-48695Pavel-odintsov fastnetmon os command injection vulnerabilityFastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() funct…EPSS 1.7%7.5CVE-2026-48688Pavel-odintsov fastnetmon out-of-bounds read vulnerabilityFastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The function decode…EPSS 0.50%7.5CVE-2024-56072Pavel-odintsov fastnetmon code injection vulnerabilityAn issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to cause a denial of service (appl…EPSS 0.72%

Source: NIST National Vulnerability Database (record CVE-2026-48692), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.