EUVD-2026-31899
GHSA-f762-5mrw-32x8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens this path with std::ios::trunc without checking for symlinks or using O_NOFOLLOW. Additionally, the chmod() call on line 2190 always operates on cli_stats_file_path regardless of which file_path parameter was passed (a bug that applies wrong permissions), and the umask is set to 0 during daemonization (src/fastnetmon.cpp line 1821), making all created files world-writable. A local attacker can exploit this to overwrite arbitrary files as the FastNetMon process user (typically root).
AnalysisAI
Local symlink exploitation in FastNetMon Community Edition through 1.2.9 allows a low-privileged local attacker to overwrite arbitrary files as the process user, which is typically root. The statistics output path is hardcoded to the predictable world-accessible location /tmp/fastnetmon.dat, written via std::ios::trunc without O_NOFOLLOW or symlink validation, and the daemon sets umask to 0 at startup making all created files world-writable. A secondary chmod() bug further misapplies permissions to the wrong path. No public exploit has been identified at time of analysis and EPSS sits at the 4th percentile, but the typical root execution context makes this a reliable local privilege escalation primitive despite the moderate CVSS score.
Technical ContextAI
FastNetMon Community Edition is an open-source high-performance DDoS detection daemon. The vulnerability is rooted in CWE-59 (Improper Link Resolution Before File Access). Three compounding implementation defects exist in the source: (1) src/fastnetmon.cpp line 159 hardcodes the statistics file path to /tmp/fastnetmon.dat - a predictable, world-accessible location; (2) the print_screen_contents_into_file() function in src/fastnetmon_logic.cpp line 2186 opens that path using std::ios::trunc without the O_NOFOLLOW or O_EXCL flags, meaning the C++ standard library will silently follow an attacker-placed symlink and truncate whatever the symlink targets; (3) during daemonization at src/fastnetmon.cpp line 1821 the process calls umask(0), causing every subsequently created file to receive permissions 0666 or 0777 - fully world-writable. A separate code bug at line 2190 applies chmod() to cli_stats_file_path regardless of the file_path parameter actually passed, meaning the wrong file can receive altered permissions. The CPE string provided by NVD (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is generic and of limited use for automated asset scanning.
RemediationAI
No vendor-released patched version has been independently confirmed from the available data - the upstream GitHub repository at https://github.com/pavel-odintsov/fastnetmon and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-48693 should be monitored for an official fix release. Until a patch is available, apply the following specific compensating controls: First, run FastNetMon under a dedicated low-privilege service account rather than root using systemd's User= and Group= directives - this is the highest-impact mitigation as it constrains the blast radius of a successful symlink attack to files owned by that account rather than the entire system; note this may require adjusting network capture permissions (e.g., CAP_NET_RAW capability). Second, pre-create /tmp/fastnetmon.dat as a regular file owned by the FastNetMon service account before daemon startup (e.g., via a systemd ExecStartPre= step) - an existing file owned by the process user prevents an attacker from replacing it with a symlink, though this mitigation must survive reboots via tmpfiles.d configuration. Third, consider mounting /tmp as a private tmpfs namespace for the FastNetMon service via systemd's PrivateTmp=true directive, which isolates the daemon's /tmp view entirely and eliminates the shared /tmp attack surface with no significant side effects for this workload.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today