CVE-2026-48694

Vulnerability

In FastNetMon Community Edition through version 1.2.9, the Juniper router integration plugin (src/juniper_plugin/fastnetmon_juniper.php) contains a configuration injection vulnerability. The $IP_ATTACK variable, received from argv[1], is directly interpolated into Juniper NETCONF set and delete commands at lines 69 and 90 without any validation or sanitization [1]. Line 69 executes set routing-options static route {$IP_ATTACK} community 65535:666 discard for banning an IP, and line 90 executes delete routing-options static route {$IP_ATTACK}/32 for unbanning [1]. The vulnerability affects all installations using the Juniper plugin with NETCONF integration [2].

Exploitation

An attacker who can control the IP address string passed to the plugin (e.g., via the attack notification pipeline) can inject additional Juniper CLI configuration commands by embedding newline characters followed by arbitrary set or delete commands [1]. No authentication is required beyond the ability to trigger a ban or unban action, which is typically possible for an attacker whose IP is detected as a source of DDoS traffic [1]. The attacker does not need direct network access to the FastNetMon host; the injection occurs through the normal attack handling flow [1].

Impact

Successful exploitation allows an attacker to modify any Juniper router configuration element accessible via NETCONF, including routing tables, firewall filters, user accounts, and other settings [1]. This results in full compromise of the affected Juniper router, with potential for denial of service, traffic redirection, or persistent backdoor access [1].

Mitigation

As of May 23, 2026, no vendor fix has been released for CVE-2026-48694 [1]. FastNetMon LTD was notified on April 25, 2026, but has not responded [1]. Users are advised to disable the Juniper plugin or restrict access to the FastNetMon attack notification pipeline until a patch is available [1]. No workaround is documented in the available references.