CVE-2026-48687

Vulnerability

The vulnerability resides in the _log() function within src/juniper_plugin/fastnetmon_juniper.php (lines 115-119) [1][3]. The function constructs a shell command by concatenating the $msg parameter directly into an exec() call: exec("echo date \"- [FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). The $msg parameter is built from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. No input validation or shell escaping is performed on these arguments. FastNetMon Community Edition through version 1.2.9 is affected [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious IP address that contains shell metacharacters (e.g., backticks, semicolons, pipes). When FastNetMon detects a DDoS attack and invokes the Juniper plugin script, the unsanitized IP is passed to _log(), leading to command injection [1]. The attacker does not require authentication to the FastNetMon server; they only need to trigger a detection event (e.g., by sending a spoofed attack traffic towards a target monitored by FastNetMon). No user interaction is needed, and the attack can be executed remotely.

Impact

Successful exploitation allows arbitrary OS command execution as the user running the PHP script (typically www-data or similar). The attacker can gain full control over the FastNetMon server, read or modify sensitive data, install backdoors, or pivot to other systems in the network. The impact is high, with potential for complete compromise of the detection infrastructure.

Mitigation

As of May 2026, no official patch has been released by FastNetMon LTD [1]. The recommended fix is to replace the exec() call with file_put_contents() or to sanitize all parameters using escapeshellarg() before constructing the command. Users can manually edit the vulnerable PHP file to implement these changes. Until a fix is available, consider disabling the Juniper plugin or restricting execution of the script via filesystem permissions. The vulnerability is not currently known to be in CISA's KEV catalog.