Pavel-Odintsov Fastnetmon vulnerabilities

CVE-2026-48687 [CRITICAL] CWE-78 CVE-2026-48687: FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Jun FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg .

CVE-2026-48689 [CRITICAL] CWE-787 CVE-2026-48689: FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, memcpy_from_object_ptr) use an incorrect bounds check of the form 'if (offset + le

CVE-2026-48686 [CRITICAL] CWE-120 CVE-2026-48686: FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (N FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the BGP packet (line 99) without validating it is 32 causes undefined behavior.

CVE-2026-48695 [HIGH] CWE-78 CVE-2026-48695: FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Mik FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg .

CVE-2026-48694 [HIGH] CWE-78 CVE-2026-48694: FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the J FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commands at lines 69 and 90 without any validation or sanitiza

CVE-2026-48692 [HIGH] CWE-306 CVE-2026-48692: FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentic FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods

CVE-2026-48691 [CRITICAL] CWE-190 CVE-2026-48691: FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)' and stores it in a uint8_t field (line 600-605)

CVE-2026-48697 [HIGH] CWE-295 CVE-2026-48697: FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connec FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer

CVE-2026-48688 [HIGH] CWE-125 CVE-2026-48688: FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH FastNetMon Community Edition through 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The function decode_mp_reach_ipv6() in src/bgp_protocol.cpp contains a TODO comment at line 156 explicitly acknowledging 'we should add sanity checks to avoid reads after attribute memory block.' The function casts raw poin

CVE-2026-48690 [HIGH] CWE-122 CVE-2026-48690: FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets * (max_captured_packet_size + sizeof(fastnetmon_pcap_pkthdr_t)) + sizeof(fastnetmon_pcap_file_header_t)' using u

CVE-2026-48685 [MEDIUM] CWE-130 CVE-2026-48685: FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly pa FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set. In src/bgp_protocol.hpp, the parse_raw_bgp_attribute() function correctly identifies when extended_length_bit is set and sets length_of_length_field to 2, but then reads only a single byte fo

CVE-2026-48684 [MEDIUM] CWE-125 CVE-2026-48684: FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.cpp), the scope parsing loop (lines 224-229) iterates until scopes_offset reaches the attacker-controlled option_scope_length value, reading netflow9_tem

CVE-2024-56072 [HIGH] CWE-94 CVE-2024-56072: An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows re An issue was discovered in FastNetMon Community Edition through 1.2.7. The sFlow v5 plugin allows remote attackers to cause a denial of service (application crash) via a crafted packet that specifies many sFlow samples.

CVE-2024-56073 [HIGH] CWE-369 CVE-2024-56073: An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Net An issue was discovered in FastNetMon Community Edition through 1.2.7. Zero-length templates for Netflow v9 allow remote attackers to cause a denial of service (divide-by-zero error and application crash).

CVE-2026-48693 [MEDIUM] CWE-59 CVE-2026-48693: FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable f FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens this path with std::ios::trunc without checking for s

CVE-2026-48696 [MEDIUM] CVE-2026-48696: FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689.