Veille CVE
CVE-2026-48693
5.5 MoyenneDescription
FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens this path with std::ios::trunc without checking for symlinks or using O_NOFOLLOW. Additionally, the chmod() call on line 2190 always operates on cli_stats_file_path regardless of which file_path parameter was passed (a bug that applies wrong permissions), and the umask is set to 0 during daemonization (src/fastnetmon.cpp line 1821), making all created files world-writable. A local attacker can exploit this to overwrite arbitrary files as the FastNetMon process user (typically root).
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 5.5 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | 5.5 Moyenne | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Faiblesses (CWE)
Références
- https://github.com/pavel-odintsov/fastnetmon Product
- https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp Product
- https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon_logic.cpp Product
- https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48693-symlink-tmp Third Party Advisory