FastNetMon Community Edition up to version 1.2.9 writes its statistics to a predictable temporary file named /tmp/fastnetmon.dat using std::ios::trunc without checking for symlinks or using O_NOFOLLOW. The daemon sets the umask to 0 during startup, making all created files world‑writable, and a permissions bug applies incorrect chmod on the file path. A local attacker can create a symlink pointing to any target file and then trigger the statistics write, causing the daemon to truncate the target file as the daemon user, typically root. This allows the attacker to overwrite arbitrary system files with root privileges.

FastNetMon Community Edition versions 1.2.9 and earlier running on Linux as root are affected. The issue does not exist in later releases where the statistics file path is changed and symlink checks are added.

The exploit requires the ability to create a symlink in /tmp or local code execution. Because the daemon runs as root, the attack would result in arbitrary file overwrite as root and could lead to full system compromise. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity for local privilege escalation. The likely attack vector is local.