Title: FastNetMon Community Edition, Description: FastNetMon Community Edition hasta la versión 1.2.9 expone un servidor API gRPC en el puerto 50052 sin mecanismo de autenticación. El servidor se inicializa con grpc::InsecureServerCredentials() (src/fastnetmon.cpp línea 477) y un comentario en el código fuente reconoce explícitamente 'Listen on the given address without any authentication mechanism.' Ninguno de los métodos RPC en src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) realiza verificación de credenciales. Los métodos ExecuteBan y ExecuteUnBan desencadenan acciones críticas para la seguridad: anuncios de ruta BGP que pueden anular el tráfico de red, y ejecución de scripts de notificación externos a través de popen(). Un atacante con acceso a la red local puede prohibir direcciones IP arbitrarias (causando denegación de servicio al tráfico legítimo), desprohibir ataques activos (desactivando la mitigación de DDoS), y desencadenar la ejecución de scripts. Tampoco hay control de acceso basado en roles que separe la monitorización de solo lectura de las operaciones administrativas destructivas.

{"timestamp":"2026-05-26T20:50:31.138175Z","id":"CVE-2026-48692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OR
          *cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:* versions up to (including) 1.2.9

MITRE: https://github.com/pavel-odintsov/fastnetmon Types: Product

MITRE: https://github.com/pavel-odintsov/fastnetmon/blob/master/src/api.cpp Types: Product

MITRE: https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp Types: Product

MITRE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-auth Types: Third Party Advisory

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-306

FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism. The server is initialized with grpc::InsecureServerCredentials() (src/fastnetmon.cpp line 477) and a source code comment explicitly acknowledges 'Listen on the given address without any authentication mechanism.' None of the RPC methods in src/api.cpp (ExecuteBan, ExecuteUnBan, GetBanlist, GetTotalTrafficCounters, etc.) perform any credential verification. The ExecuteBan and ExecuteUnBan methods trigger security-critical actions: BGP route announcements that can blackhole network traffic, and execution of external notification scripts via popen(). An attacker with local network access can ban arbitrary IP addresses (causing denial of service to legitimate traffic), unban active attacks (disabling DDoS mitigation), and trigger script execution. There is also no role-based access control separating read-only monitoring from destructive administrative operations.

https://github.com/pavel-odintsov/fastnetmon

https://github.com/pavel-odintsov/fastnetmon/blob/master/src/api.cpp

https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp

https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48692-grpc-no-auth