PT-2026-43354 · Unknown+1 · Fastnetmon Community Edition+1

Published 2026-05-26 · Updated 2026-06-15 · CVE-2026-48694

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FastNetMon Community Edition versions prior to 1.3.0

Description A configuration injection issue exists in the Juniper router integration plugin. In the file src/juniper plugin/fastnetmon juniper.php, the variable IP ATTACK (received from argv[1]) is interpolated into Juniper NETCONF set-configuration commands without validation or sanitization. An attacker capable of controlling the IP address string can inject arbitrary Juniper CLI configuration commands by embedding newline characters. This allows for the modification of the router's routing table, firewall filters, user accounts, or any other configuration element accessible via NETCONF, potentially leading to full router compromise.

Recommendations Update to a version later than 1.2.9. As a temporary workaround, restrict access to the src/juniper plugin/fastnetmon juniper.php plugin to minimize the risk of exploitation.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-48694

USN-8429-1

Affected Products

Fastnetmon Community Edition

Juniper Router

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2026-48694 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-48694 · Security Note
• https://ubuntu.com/security/CVE-2026-48687 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48686 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-48694 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48689 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8429-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48694 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48694 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48691 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8429-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48694 · Vendor Advisory
• https://github.com/pavel-odintsov/fastnetmon/commit/6f58184fb60248df011c4c379bf445e07609ad27 · Note
• https://github.com/pavel-odintsov/fastnetmon · Note
• https://github.com/pavel-odintsov/fastnetmon/pull/1049 · Note