CVE-2026-48694

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commands at lines 69 and 90 without any validation or sanitization. Line 69: $conn->load_set_configuration("set routing-options static route {$IP_ATTACK} community 65535:666 discard"). Line 90: $conn->load_set_configuration("delete routing-options static route {$IP_ATTACK}/32"). An attacker who can control the IP address string can inject additional Juniper CLI configuration commands by embedding newline characters followed by arbitrary set/delete commands. This could modify the router's routing table, firewall filters, user accounts, or any other configuration element accessible via NETCONF. The impact is full router compromise.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pavel-odintsov/fastnetmon	Product
https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*

History

No history.

Information

Published : 2026-05-26 18:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-48694

Mitre link : CVE-2026-48694

CVE.ORG link : CVE-2026-48694

JSON object : View

Products Affected

pavel-odintsov

fastnetmon

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-48694", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48694", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-26T20:27:27.425815Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-26T18:16:52.840", "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commands at lines 69 and 90 without any validation or sanitization. Line 69: $conn->load_set_configuration(\"set routing-options static route {$IP_ATTACK} community 65535:666 discard\"). Line 90: $conn->load_set_configuration(\"delete routing-options static route {$IP_ATTACK}/32\"). An attacker who can control the IP address string can inject additional Juniper CLI configuration commands by embedding newline characters followed by arbitrary set/delete commands. This could modify the router's routing table, firewall filters, user accounts, or any other configuration element accessible via NETCONF. The impact is full router compromise."}, {"lang": "es", "value": "FastNetMon Community Edition hasta la 1.2.9 contiene una vulnerabilidad de inyecci\u00f3n de configuraci\u00f3n en el plugin de integraci\u00f3n del router Juniper. En src/juniper_plugin/fastnetmon_juniper.php, la variable $IP_ATTACK (recibida de argv[1]) se interpola directamente en los comandos de configuraci\u00f3n 'set' de Juniper NETCONF en las l\u00edneas 69 y 90 sin ninguna validaci\u00f3n o saneamiento. L\u00ednea 69: $conn -> load_set_configuration(\"set routing-options static route {$IP_ATTACK} community 65535:666 discard\"). L\u00ednea 90: $conn -> load_set_configuration(\"delete routing-options static route {$IP_ATTACK}/32\"). Un atacante que puede controlar la cadena de la direcci\u00f3n IP puede inyectar comandos de configuraci\u00f3n CLI de Juniper adicionales incrustando caracteres de nueva l\u00ednea seguidos de comandos 'set'/'delete' arbitrarios. Esto podr\u00eda modificar la tabla de enrutamiento del router, los filtros del cortafuegos, las cuentas de usuario o cualquier otro elemento de configuraci\u00f3n accesible a trav\u00e9s de NETCONF. El impacto es el compromiso total del router."}], "lastModified": "2026-07-24T11:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "E712A01F-3AD7-4CC2-9A8B-F8C63756EBBF", "versionEndIncluding": "1.2.9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}