PT-2026-43355 · Unknown · Fastnetmon Community Edition

Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-48695

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FastNetMon Community Edition versions prior to 1.2.10

Description An OS command injection issue exists in the MikroTik router integration plugin. The log() function in src/mikrotik plugin/fastnetmon mikrotik.php constructs shell commands by concatenating the $msg parameter directly into exec() calls. Because the $msg variable contains unsanitized data from command-line arguments, an attacker capable of influencing argv[] values can inject and execute arbitrary shell commands.

Recommendations Update FastNetMon Community Edition to version 1.2.10 or later. Replace the exec() function with file put contents() or implement escapeshellarg() to sanitize the $msg parameter.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-48695

Affected Products

Fastnetmon Community Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-48695 · Security Note
• https://github.com/pavel-odintsov/fastnetmon/blob/master/src/mikrotik_plugin/fastnetmon_mikrotik.php · Note
• https://github.com/pavel-odintsov/fastnetmon · Note
• https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48695-mikrotik-cmd-injection · Note
• https://t.me/cveNotify/164870 · Telegram Post