FastNetMon Community Edition through 1.2.9 does not validate TLS certificates on outbound HTTPS requests. The execute_web_request_secure function builds a boost::asio::ssl::context in client mode and loads CA certificates but never sets peer verification, allowing OpenSSL to accept any server certificate during the handshake. This flaw, classified as CWE‑295, effectively turns telemetry traffic to community‑stats.fastnetmon.com into a potential man‑in‑the‑middle channel. An attacker who can observe or inject traffic to that endpoint can modify or redirect telemetry data that contains system and network information.

All installations of FastNetMon Community Edition using a build version 1.2.9 or earlier are affected. The issue is present in src/fast_library.cpp and impacts the telemetry reporting routine that contacts community‑stats.fastnetmon.com. Users should verify their installed version against the official repository.

The vulnerability carries a CVSS score of 7.4, indicating high severity. No EPSS value is available, and it is not listed in CISA’s KEV catalog. The attack requires the ability to intercept or inject network traffic to the telemetry endpoint; no local privileges are needed. Because certificate verification is never performed, any intercepted TLS session will be accepted by the client, enabling a remote attacker to read or alter telemetry data or redirect it to a malicious server. Immediate remediation is advised given the lack of built‑in mitigation in current binaries.