CVE-2026-48697 Details
Description
FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.
A vulnerability exists in FastNetMon Community Edition versions through 1.2.9, where the application fails to properly validate TLS certificates for outbound HTTPS connections. This issue arises in the 'execute_web_request_secure()' function within 'src/fast_library.cpp'. The function sets up a Boost.Asio SSL context for the TLS client, loads CA certificates, but neglects to enable verification of the server's certificate chain. As a result, all HTTPS connections are susceptible to man-in-the-middle attacks. This vulnerability affects the telemetry reporting feature, which sends system information to 'community-stats.fastnetmon.com'. An attacker could intercept, modify, or redirect this data to a malicious server.
Users can disable the telemetry feature by setting 'community_stats_enable' to 'false' in the FastNetMon configuration file. Alternatively, if a forward proxy is available, it can be used to properly validate the TLS connection before it reaches 'community-stats.fastnetmon.com'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pavel-odintsov fastnetmon | <= 1.2.9 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |