CVE-2026-48695 Details

A command injection vulnerability has been identified in the FastNetMon Community Edition MikroTik router integration plugin, affecting versions through 1.2.9. The vulnerability arises from the `_log()` function in `fastnetmon_mikrotik.php`, where shell commands are constructed by directly concatenating unsanitized input from command-line arguments into `exec()` calls. This allows an attacker to inject arbitrary shell commands. Additionally, the plugin contains hardcoded MikroTik API credentials, which can be exploited if the router's API port is accessible.

Users are advised to update the FastNetMon MikroTik plugin to a version that removes the command injection vulnerability and the hardcoded credentials. The plugin should be modified to externalize credentials into a secure configuration file, and the `exec()` function should be replaced with `file_put_contents()` to prevent command injection.