CVE-2026-48687
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
FastNetMon Community Edition up to version 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls. The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], representing the attack IP address, direction, and power.
Risk Assessment
The risk is that an attacker can execute arbitrary system commands if the script is invoked directly, by another orchestration system, or due to future code changes passing string-sourced IPs. This could lead to full server compromise and loss of data confidentiality, integrity, and availability.
Recommendation
Immediately upgrade FastNetMon to version 1.2.10 or later, which includes the fix. If upgrading is not possible, replace exec() calls with file_put_contents() or apply escapeshellarg() to all parameters passed to the shell.
Original NVD description (English source)
FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. While FastNetMon's C++ core currently passes IP addresses via inet_ntoa() (which only produces safe dotted-decimal notation), the PHP script performs no input validation or shell escaping. If the script is invoked directly, by another orchestration system, or if future code changes pass string-sourced IPs, arbitrary commands can be injected. The correct fix is to replace exec() with file_put_contents() or use escapeshellarg() on all parameters.