CVE-2026-48693

FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens this path with std::ios::trunc without checking for symlinks or using O_NOFOLLOW. Additionally, the chmod() call on line 2190 always operates on cli_stats_file_path regardless of which file_path parameter was passed (a bug that applies wrong permissions), and the umask is set to 0 during daemonization (src/fastnetmon.cpp line 1821), making all created files world-writable. A local attacker can exploit this to overwrite arbitrary files as the FastNetMon process user (typically root).

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pavel-odintsov/fastnetmon	Product
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp	Product
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon_logic.cpp	Product
https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48693-symlink-tmp	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*

History

No history.

Information

Published : 2026-05-26 17:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-48693

Mitre link : CVE-2026-48693

CVE.ORG link : CVE-2026-48693

JSON object : View

Products Affected

pavel-odintsov

fastnetmon

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-48693", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48693", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T20:33:34.242754Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T17:16:53.807", "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon.cpp", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/fastnetmon_logic.cpp", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48693-symlink-tmp", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' (src/fastnetmon.cpp line 159). The print_screen_contents_into_file() function (src/fastnetmon_logic.cpp line 2186) opens this path with std::ios::trunc without checking for symlinks or using O_NOFOLLOW. Additionally, the chmod() call on line 2190 always operates on cli_stats_file_path regardless of which file_path parameter was passed (a bug that applies wrong permissions), and the umask is set to 0 during daemonization (src/fastnetmon.cpp line 1821), making all created files world-writable. A local attacker can exploit this to overwrite arbitrary files as the FastNetMon process user (typically root)."}, {"lang": "es", "value": "FastNetMon Community Edition hasta la versi\u00f3n 1.2.9 es vulnerable a un ataque de symlink local a trav\u00e9s de rutas de archivo predecibles en /tmp. La ruta del archivo de estad\u00edsticas por defecto es '/tmp/fastnetmon.dat' (src/fastnetmon.cpp l\u00ednea 159). La funci\u00f3n print_screen_contents_into_file() (src/fastnetmon_logic.cpp l\u00ednea 2186) abre esta ruta con std::ios::trunc sin verificar symlinks o usar O_NOFOLLOW. Adem\u00e1s, la llamada a chmod() en la l\u00ednea 2190 siempre opera sobre cli_stats_file_path independientemente del par\u00e1metro file_path que se haya pasado (un error que aplica permisos incorrectos), y el umask se establece en 0 durante la demonizaci\u00f3n (src/fastnetmon.cpp l\u00ednea 1821), haciendo que todos los archivos creados sean de escritura global. Un atacante local puede explotar esto para sobrescribir archivos arbitrarios como el usuario del proceso de FastNetMon (t\u00edpicamente root)."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "E712A01F-3AD7-4CC2-9A8B-F8C63756EBBF", "versionEndIncluding": "1.2.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}