Vulnerability Description
FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pavel-Odintsov | Fastnetmon | <= 1.2.9 |
Related Weaknesses (CWE)
References
- https://github.com/pavel-odintsov/fastnetmonProduct
- https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fast_library.cppProduct
- https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48697-missing-tls-validatiThird Party Advisory
FAQ
What is CVE-2026-48697?
CVE-2026-48697 is a vulnerability with a CVSS score of 7.4 (HIGH). FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl:...
How severe is CVE-2026-48697?
CVE-2026-48697 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-48697?
Check the references section above for vendor advisories and patch information. Affected products include: Pavel-Odintsov Fastnetmon.