What is the CVSS score of EUVD-2026-31843?

EUVD-2026-31843 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate EUVD-2026-31843?

Within 24 hours: Inventory all FastNetMon Community Edition deployments and document version numbers and operational criticality. Within 7 days: Implement access controls restricting who can invoke the Juniper plugin script directly, disable the Juniper integration if not in active use, and review logs for any suspicious execution patterns. Within 30 days: Monitor vendor channels for patch availability and prepare upgrade procedures; if no patch emerges, evaluate migration to an alternative network monitoring solution.

FastNetMon EUVD-2026-31843

| CVE-2026-48687 CRITICAL

OS Command Injection (CWE-78)

2026-05-26 mitre

GHSA-qx97-6jw5-h44w

Command Injection PHP Juniper N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:39 vuln.today

CVSS changed

May 27, 2026 - 19:37 NVD

9.8 (CRITICAL)

CVE Published

May 26, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118) constructs shell commands by concatenating the $msg parameter directly into exec() calls: exec("echo date \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP). The $msg variable contains unsanitized data derived from command-line arguments argv[1] through argv[3], which represent the attack IP address, direction, and power. While FastNetMon's C++ core currently passes IP addresses via inet_ntoa() (which only produces safe dotted-decimal notation), the PHP script performs no input validation or shell escaping. If the script is invoked directly, by another orchestration system, or if future code changes pass string-sourced IPs, arbitrary commands can be injected. The correct fix is to replace exec() with file_put_contents() or use escapeshellarg() on all parameters.

AnalysisAI

OS command injection in FastNetMon Community Edition (through 1.2.9) lets attacker-controlled input reach an unescaped exec() call inside the Juniper router integration plugin, enabling arbitrary shell command execution on the host. The flaw lives in the _log() function of src/juniper_plugin/fastnetmon_juniper.php, where the $msg argument (built from argv[1]-argv[3]: attack IP, direction, power) is concatenated directly into a shell command. Although rated CVSS 9.8, practical exploitation is gated: FastNetMon's C++ core currently feeds IPs through inet_ntoa(), which only yields safe dotted-decimal strings, so injection requires the script to be driven directly or by a third-party orchestrator. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP helper script that FastNetMon uses to integrate with Juniper routers for automated DDoS/blackhole actions. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). At lines 117-118 the _log() function builds a logging command via string concatenation - exec("echo date \"- {FASTNETMON] - " . $msg . " \" >> " . $FILE_LOG_TMP) - passing it to PHP's exec(). Because PHP exec() invokes a system shell, both the embedded backtick date and any shell metacharacters in $msg (e.g. ;, |, $(), backticks) are interpreted, not treated as literal text. No escapeshellarg(), escapeshellcmd(), or input validation is applied to the argv-derived parameters. The CPE string supplied (cpe:2.3:a:n/a:n/a:*) is a placeholder and contributes no usable product/version data.

RemediationAI

No vendor-released patch (fixed version) is identified at time of analysis; the references point to the source repository and a research blog rather than a tagged release or merged fix commit. The researcher-recommended code fix is to stop using exec() for logging - write the log line with file_put_contents() instead - or, if exec() must remain, wrap every parameter ($msg and the argv-derived IP/direction/power values) in escapeshellarg() and validate that the IP is well-formed dotted-decimal before use. Until an upstream fix is available, apply compensating controls: restrict filesystem and execution permissions so only the FastNetMon service account can invoke fastnetmon_juniper.php (prevents direct/manual invocation with crafted arguments, with no functional side effect); do not connect this plugin to any external orchestration layer that could pass unvalidated or string-sourced IPs (may require reworking custom automation); and add input validation/allowlisting on any wrapper that calls the script. Track the upstream repository and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-48687 for a patched release.