Vulnerability · Published May 26, 2026 · Assigned by mitre
CVE-2026-48697
High 7.4
In plain English
A high-severity improper certificate validation in the fastnetmon package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode and calls set_default_verify_paths() to load CA certificates, but never calls set_verify_mode(boost::asio::ssl::verify_peer). Without this call, OpenSSL performs the TLS handshake without validating the server's certificate chain, making all HTTPS connections vulnerable to man-in-the-middle attacks. This function is used for telemetry reporting to community-stats.fastnetmon.com, which sends system information including CPU model, kernel version, traffic statistics, and software configuration. An attacker can intercept and modify this data or redirect it to a malicious server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48697 |
| Debian:13 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48697 |
| Debian:14 | fastnetmon | no fix listed | DEBIAN-CVE-2026-48697 |
| Ubuntu:25.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48697 |
| Ubuntu:26.10 | fastnetmon | no fix listed | UBUNTU-CVE-2026-48697 |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N