FastNetMon Community Edition releases up to version 1.2.9 expose a gRPC API server on port 50052 that is started with insecure credentials, as confirmed by source comments. The exposed RPC methods—ExecuteBan, ExecuteUnban, GetBanlist, GetTotalTrafficCounters, and others that invoke popen()—perform no credential checking or role-based access control. An attacker who can contact the service can trigger administrative actions such as BGP route announcements that blackhole legitimate traffic, unban IP addresses to disable DDoS mitigation, or execute arbitrary scripts on the host, effectively achieving remote code execution.

All FastNetMon Community Edition binaries distributed through version 1.2.9 contain this flaw. No other vendors or product versions are listed in the CVE payload, so the vulnerability applies exclusively to the Community Edition source code packaged in these releases. The gRPC listener operates on TCP port 50052, and local or network access to this port is sufficient to exploit the issue.

The CVSS score of 8.1 indicates a high severity flaw, and the EPSS score is not available; the vulnerability is not catalogued in CISA KEV. Because the service accepts connections on a reachable port with no authentication, an attacker who can reach the host or network can invoke any RPC method. The combination of potential network-level manipulation and execution of arbitrary code via popen() provides a high-impact avenue for attackers, making the threat significant if local network access is achievable.