FastNetMon Community Edition through release 1.2.9 decodes BGP NLRI messages without validating the prefix bit length. The vulnerable function read a value directly from the network and used it to determine the number of bytes for an IPv4 mask, leading to a stack-based buffer overflow when the value exceeds 32. An attacker can craft a BGP UPDATE with an oversized prefix length, overwrite the stack, and achieve arbitrary code execution on the host running FastNetMon.

FastNetMon Community Edition up to and including version 1.2.9. The issue is present in the source file bgp_protocol.cpp where the prefix_bit_length field from BGP packets is unchecked. No other products are affected.

The absence of input validation allows a stack corruption that can be leveraged to achieve remote code execution, so the overall risk is high. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to send a malicious BGP UPDATE packet to the FastNetMon instance, which is typically reachable from other routers or the public internet. Once the packet is processed, the overflow can be triggered without additional authentication, making exploitation straightforward for attackers who can reach the BGP session.