High

Security advisory

Type: advisorySources: OSVCVE: CVE-2026-48692

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-48692
Confirmed fixed CVEs: Not specified
Updated in this feed: 4 Nov 2026, 07:53 UTC · Revision 1

Source evidence

CVE-2026-48692

core-osv · Original source

Published 26 May 2026, 00:00 UTC

osv:CVE-2026-48692

Complete source record

{
  "id": "2b7aedc4ec8169cd3836fdb446cf046845378cb3a38295b7d035fce33038ed34",
  "url": "https://osv.dev/vulnerability/CVE-2026-48692",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2026-48692",
    "summary": "FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.",
    "evidence": "osv:CVE-2026-48692",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-48692",
      "aliases": [
        "CVE-2026-48692"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/pavel-odintsov/fastnetmon",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "394fbe06d112f9609d3d1cb10d60cbf98347c96a"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.2.9"
                      }
                    ],
                    "source": "DESCRIPTION"
                  },
                  {
                    "cpe": "cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.2.9"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.2.9",
            "v1.2.8",
            "v1.2.7",
            "v1.2.6",
            "v1.2.5",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.9",
            "v1.1.8",
            "v1.1.7",
            "v1.1.6",
            "v1.1.5",
            "v1.1.4",
            "v1.1.3",
            "v1.1.2",
            "v1.1.0",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48692.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.692367717Z",
      "provider": "osv",
      "references": [
        "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/api.cpp",
        "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48692.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-48692",
        "https://github.com/pavel-odintsov/fastnetmon",
        "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-auth"
      ],
      "provider_metadata": {
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48692.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-48692",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500982,
  "published_at": "2026-05-26T00:00:00+00:00"
}