CVE-2026-48694 Details
Description
FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commands at lines 69 and 90 without any validation or sanitization. Line 69: $conn->load_set_configuration("set routing-options static route {$IP_ATTACK} community 65535:666 discard"). Line 90: $conn->load_set_configuration("delete routing-options static route {$IP_ATTACK}/32"). An attacker who can control the IP address string can inject additional Juniper CLI configuration commands by embedding newline characters followed by arbitrary set/delete commands. This could modify the router's routing table, firewall filters, user accounts, or any other configuration element accessible via NETCONF. The impact is full router compromise.
A configuration injection vulnerability has been identified in FastNetMon Community Edition versions through 1.2.9, specifically within the Juniper router integration plugin. The vulnerability arises because the $IP_ATTACK variable, sourced from command-line arguments, is directly inserted into Juniper NETCONF set-configuration commands without any validation or sanitization. This flaw allows an attacker to inject additional Junos CLI commands by embedding newline characters followed by arbitrary set or delete commands. Exploitation of this vulnerability could lead to unauthorized modifications of the router's configuration, including the routing table, firewall filters, and user accounts, potentially resulting in a full compromise of the affected router.
Users can validate the IP address format in a wrapper script before calling the FastNetMon Juniper plugin. Additionally, restricting the NETCONF account's privileges can mitigate the impact of any potential exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pavel-odintsov/fastnetmon | [email protected] | Product |
| https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pavel-odintsov fastnetmon | <= 1.2.9 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |