CVE-2026-48692

The record

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

Affected packages

Related vulnerabilities

• CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes… CWE-306
• CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-306
• CVE-2026-53714 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-306
• CVE-2026-89261 MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search… CWE-306
• CVE-2026-89250 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an… CWE-306
• CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies, has a… CWE-306
• CVE-2026-88285 GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without… CWE-306
• CVE-2026-87924 A security vulnerability has been detected in Rizwan17 inventory-management-system up to… CWE-306