FastNetMon Community Edition up to 1.2.9 fastnetmon_juniper.php _log msg os command injection

Summaryinfo

A vulnerability marked as critical has been reported in FastNetMon Community Edition up to 1.2.9. Affected by this issue is the function _log of the file src/juniper_plugin/fastnetmon_juniper.php. The manipulation of the argument msg leads to os command injection. This vulnerability is listed as CVE-2026-48687. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in FastNetMon Community Edition up to 1.2.9. This issue affects the function _log of the file src/juniper_plugin/fastnetmon_juniper.php. The manipulation of the argument msg with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo `date` \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. While FastNetMon's C++ core currently passes IP addresses via inet_ntoa() (which only produces safe dotted-decimal notation), the PHP script performs no input validation or shell escaping. If the script is invoked directly, by another orchestration system, or if future code changes pass string-sourced IPs, arbitrary commands can be injected. The correct fix is to replace exec() with file_put_contents() or use escapeshellarg() on all parameters.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-48687 since 05/22/2026. The exploitation is known to be easy. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/19/2026). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

By approaching the search of inurl:src/juniper_plugin/fastnetmon_juniper.php it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 321184 (Ubuntu 20.04 LTS / 24.04 LTS / 26.04 LTS : FastNetMon vulnerabilities (USN-8429-1)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (321184). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• FastNetMon

Name

• Community Edition

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion