CVE-2026-48696

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class. Five methods use an incorrect bounds check, allowing writing exactly one byte past the end of the heap-allocated buffer. An attacker sending network traffic (NetFlow, sFlow, IPFIX, or BGP) can trigger this overflow, potentially achieving arbitrary code execution.

Integer overflow in FastNetMon Community Edition up to 1.2.9 in the BGP AS_PATH attribute encoder leads to a heap buffer overflow.

FastNetMon Community Edition up to version 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls. The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], representing the attack IP address, direction, and power.

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the BGP packet without validating it is <= 32 for IPv4 prefixes. This value is passed to how_much_bytes_we_need_for_storing_certain_subnet_mask() which computes ceil(prefix_bit_length / 8), returning up to 32 bytes for a prefix_bit_length of 255. The result is used as the length argument to memcpy() copying into a 4-byte uint32_t stack variable (prefix_ipv4), causing a stack buffer overflow of up to 28 bytes, which can be exploited for arbitrary code execution. Additionally, the unvalidated prefix_bit_length is passed to convert_cidr_to_binary_netmask_local_function_copy(), where a shift of (32 - cidr) with cidr > 32 causes undefined behavior.

FastNetMon Community Edition through 1.2.9 has an out-of-bounds read in the IPv4 packet parser. After validating at least 20 bytes, the code advances the pointer by 4 * IHL without checking IHL >= 5 or available bytes. IHL=15 with only 20 bytes causes a 40-byte over-read; IHL 0-4 leads to type confusion.

FastNetMon Community Edition up to version 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls. An attacker who can influence argv[] values can inject arbitrary shell commands.

FastNetMon Community Edition up to version 1.2.9 has a configuration injection vulnerability in the Juniper router integration plugin. The $IP_ATTACK variable (from argv[1]) is directly interpolated into NETCONF commands without validation, allowing an attacker to inject additional Juniper CLI commands via newline characters. This can lead to modification of routing tables, firewall filters, user accounts, and other configuration elements.

Vulnerability in FastNetMon Community Edition up to version 1.2.9. A local attacker can exploit predictable file paths in /tmp to overwrite arbitrary files as the FastNetMon user (typically root).

FastNetMon Community Edition up to 1.2.9 exposes an unauthenticated gRPC API on port 50052. An attacker with network access can ban IPs, unban attacks, and execute external scripts.

FastNetMon Community Edition up to version 1.2.9 contains multiple out-of-bounds reads in the BGP MP_REACH_NLRI IPv6 attribute decoder. The decode_mp_reach_ipv6() function does not validate data before use, allowing an attacker to control field lengths and trigger out-of-bounds reads.