CVE-2026-48683
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
FastNetMon Community Edition through 1.2.9 has an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. The Data template branch iterates without bounds checking, while the Options template branch does. Since templates are sent via unauthenticated UDP, an attacker can craft templates to read memory past the packet buffer.
Risk Assessment
An attacker can leak sensitive memory contents or crash the NetFlow processor, potentially disrupting network monitoring and causing information disclosure.
Recommendation
Upgrade FastNetMon Community Edition to version 1.2.10 or later, which includes bounds checking in the Data template branch.
Other vulnerabilities in FastNetMon Community Edition
See all- CVE-2026-48697High
FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function fails to call set_verify_mode(verify_peer), so OpenSSL does not validate the server's certificate chain. This function is used for telemetry reporting, sending system information.
- CVE-2026-48690High
In FastNetMon Community Edition up to 1.2.9, an integer overflow in the packet capture buffer allocation function allocate_buffer() leads to a smaller-than-expected buffer and subsequent heap corruption via out-of-bounds writes.
Original NVD description (English source)
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow_v9_collector.cpp, the Data template branch (lines 1695-1702) iterates over flow records without performing a per-iteration bounds check against the packet end pointer. In contrast, the Options template branch (lines 1709-1719) correctly checks 'if (pkt + offset + field_template->total_length > packet_end)' before each iteration. The Data branch omits this check entirely. Since template definitions are sent by the network peer (and are unauthenticated UDP), an attacker can craft templates that cause the parser to read arbitrary memory past the packet buffer. This can leak sensitive memory contents or cause a crash.