CVE-2026-48687

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. While FastNetMon's C++ core currently passes IP addresses via inet_ntoa() (which only produces safe dotted-decimal notation), the PHP script performs no input validation or shell escaping. If the script is invoked directly, by another orchestration system, or if future code changes pass string-sourced IPs, arbitrary commands can be injected. The correct fix is to replace exec() with file_put_contents() or use escapeshellarg() on all parameters.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pavel-odintsov/fastnetmon	Product
https://github.com/pavel-odintsov/fastnetmon/blob/master/src/juniper_plugin/fastnetmon_juniper.php	Product
https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48687-juniper-cmd-injection	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*

History

No history.

Information

Published : 2026-05-26 16:16

Updated : 2026-07-21 19:10

NVD link : CVE-2026-48687

Mitre link : CVE-2026-48687

CVE.ORG link : CVE-2026-48687

JSON object : View

Products Affected

pavel-odintsov

fastnetmon

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-48687", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48687", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-27T17:23:45.698795Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T16:16:26.800", "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/juniper_plugin/fastnetmon_juniper.php", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48687-juniper-cmd-injection", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec(\"echo `date` \\\"- {FASTNETMON] - \" . $msg . \" \\\" >> \" . $FILE_LOG_TMP). The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. While FastNetMon's C++ core currently passes IP addresses via inet_ntoa() (which only produces safe dotted-decimal notation), the PHP script performs no input validation or shell escaping. If the script is invoked directly, by another orchestration system, or if future code changes pass string-sourced IPs, arbitrary commands can be injected. The correct fix is to replace exec() with file_put_contents() or use escapeshellarg() on all parameters."}, {"lang": "es", "value": "FastNetMon Community Edition hasta la versi\u00f3n 1.2.9 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en el plugin de integraci\u00f3n del router Juniper. La funci\u00f3n _log() en src/juniper_plugin/fastnetmon_juniper.php (l\u00edneas 117-118) construye comandos de shell concatenando el par\u00e1metro $msg directamente en las llamadas a exec(): exec('echo 'date' \\\"- {FASTNETMON] - ' . $msg . ' \\\" >> ' . $FILE_LOG_TMP). La variable $msg contiene datos no saneados derivados de los argumentos de l\u00ednea de comandos argv[1] a argv[3], que representan la direcci\u00f3n IP de ataque, la direcci\u00f3n y la potencia. Si bien el n\u00facleo C++ de FastNetMon actualmente pasa direcciones IP a trav\u00e9s de inet_ntoa() (que solo produce notaci\u00f3n decimal con puntos segura), el script PHP no realiza validaci\u00f3n de entrada ni escape de shell. Si el script se invoca directamente, por otro sistema de orquestaci\u00f3n, o si futuros cambios de c\u00f3digo pasan direcciones IP de origen de cadena, se pueden inyectar comandos arbitrarios. La soluci\u00f3n correcta es reemplazar exec() con file_put_contents() o usar escapeshellarg() en todos los par\u00e1metros."}], "lastModified": "2026-07-21T19:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "E712A01F-3AD7-4CC2-9A8B-F8C63756EBBF", "versionEndIncluding": "1.2.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}