Executive brief
FastNetMon Community Edition, a DDoS detection and mitigation tool, contains a management interface that does not require a password or any form of authentication. This allows anyone with access to the management port to block legitimate internet traffic, disable active DDoS protections, or execute unauthorized scripts on the server. While restricted to the local server by default, any configuration changes to allow remote management expose the system to significant risk of service outages and network disruption.
Technical details
The gRPC API server in FastNetMon Community Edition (through v1.2.9) is initialized using 'grpc::InsecureServerCredentials()' in 'src/fastnetmon.cpp', explicitly bypassing authentication. None of the RPC methods defined in 'src/api.cpp'—including ExecuteBan, ExecuteUnBan, and GetBanlist—perform credential verification or implement role-based access control. An attacker with access to the gRPC port (defaulting to localhost but often reconfigured to 0.0.0.0 for remote management) can trigger BGP blackhole announcements to drop traffic for arbitrary IP addresses, disable existing mitigations, or trigger external notification scripts via popen(). As of the advisory date, no official patch has been released, and the vulnerability is inherent to the current design of the Community Edition's API.
Affected products
- FastNetMon FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: other: Vendor notified by Lorikeet Security
- 2026-05-26: advisory: Vulnerability disclosed by Lorikeet Security and published in NVD