CVE-2026-48692

Katalog CVE

CVSS 8.1 · High EPSS 0,38%

Kerentanan Missing Authentication for Critical Function pada pavel-odintsov fastnetmon. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

Rincian

Terbit di NVD

26 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-auth advisory pihak ketiga
• https://github.com/pavel-odintsov/fastnetmon product
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/api.cpp product
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp product