What is the CVSS score of CVE-2026-48695?

CVE-2026-48695 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of FastNetMon Community Edition are affected by CVE-2026-48695?

FastNetMon Community Edition (through 1.2.9) contains a remote code execution vulnerability in its MikroTik router integration affecting authenticated users, with no public exploit identified at time…

How to fix or mitigate CVE-2026-48695?

Within 24 hours: Identify and catalog all FastNetMon Community Edition installations running version 1.2.9 or earlier; disable the MikroTik router integration plugin. Within 7 days: Restrict FastNetMon management interface access to authorized personnel only and enforce multi-factor authentication for all administrative accounts. Within 30 days: Monitor vendor advisories for patch releases; plan upgrade to FastNetMon Enterprise Edition or migration to alternative network monitoring solution.

FastNetMon Community Edition CVE-2026-48695

EUVD-2026-31949 HIGH

OS Command Injection (CWE-78)

2026-05-26 mitre

GHSA-vh5g-h8jm-q2cw

PHP Mikrotik Juniper Command Injection N A

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:09 vuln.today

CVSS changed

May 26, 2026 - 21:22 NVD

8.1 (HIGH)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The _log() function in src/mikrotik_plugin/fastnetmon_mikrotik.php (lines 107-108) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo date \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). This is identical in pattern to the Juniper plugin vulnerability. The $msg variable contains unsanitized attack data from command-line arguments. An attacker who can influence argv[] values can inject arbitrary shell commands. The fix is to replace exec() with file_put_contents() or use escapeshellarg().

AnalysisAI

OS command injection in FastNetMon Community Edition through 1.2.9 lets an authenticated network attacker execute arbitrary shell commands via the MikroTik router integration plugin by influencing argv[] values passed to the unsanitized _log() function. The flaw mirrors a previously disclosed Juniper plugin issue in the same project, and while a public technical write-up exists at lorikeetsecurity.com, no public exploit code or active exploitation has been identified, with EPSS at 0.05% (17th percentile).

Technical ContextAI

FastNetMon is an open-source DDoS detection and mitigation tool, and its MikroTik integration is implemented in PHP at src/mikrotik_plugin/fastnetmon_mikrotik.php. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): lines 107-108 of _log() build a shell command by string-concatenating the $msg parameter into PHP's exec() call (exec("echo date ... " . $msg . " >> " . $FILE_LOG_TMP)), and $msg is derived from command-line arguments passed by FastNetMon's core when an attack event is dispatched to the plugin. Because PHP's exec() invokes /bin/sh, any shell metacharacters such as backticks, $(), semicolons, or pipes in $msg are interpreted by the shell rather than treated as literal text, turning attacker-controllable log content into command execution.

RemediationAI

No vendor-released patch identified at time of analysis; the public write-up at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48695-mikrotik-cmd-injection recommends replacing the exec() call in _log() with file_put_contents() (eliminating shell invocation entirely) or, if exec() must be retained, wrapping the $msg argument in escapeshellarg() to neutralize shell metacharacters - operators can apply this change locally to src/mikrotik_plugin/fastnetmon_mikrotik.php at lines 107-108 pending an upstream release. As a compensating control until the patch is applied, disable the MikroTik integration plugin (and review the Juniper plugin for the same pattern) which will stop the affected code path at the cost of losing automated MikroTik mitigation actions; alternatively, run FastNetMon as an unprivileged service account isolated from the rest of the host so that successful command execution is constrained, accepting that this does not prevent exploitation, only blast radius. Monitor the upstream repository at https://github.com/pavel-odintsov/fastnetmon for a tagged release containing the fix.