Executive brief
FastNetMon Community Edition, a tool used for monitoring network traffic and detecting DDoS attacks, contains a security flaw in how it processes BGP (Border Gateway Protocol) messages. An attacker can send specially crafted network routing updates that cause the software to read beyond its intended memory boundaries. This could allow an attacker to crash the service or potentially access sensitive information from the system's memory, such as routing tables or peer data.
Technical details
The vulnerability exists in the decode_mp_reach_ipv6() function within src/bgp_protocol.cpp. The parser fails to validate the length of BGP attributes before performing pointer arithmetic and memory copies. Specifically, it casts raw pointers to structure types without size verification, uses attacker-controlled 'length_of_next_hop' fields to determine memcpy sizes, and calculates prefix lengths using unvalidated offsets. A remote attacker can exploit this by sending malformed BGP MP_REACH_NLRI attributes, leading to out-of-bounds reads. This can result in a denial-of-service (crash) or the disclosure of sensitive heap/stack memory, such as route table entries or peer state. As of the advisory date, no official patch has been released.
Affected products
- FastNetMon FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: other: Lorikeet Security notified FastNetMon LTD
- 2026-05-23: advisory: Public disclosure by Lorikeet Security
- 2026-05-26: disclosed: CVE-2026-48688 published to NVD