Title: FastNetMon Community Edition, Description: FastNetMon Community Edition hasta la 1.2.9 contiene una vulnerabilidad de inyección de configuración en el plugin de integración del router Juniper. En src/juniper_plugin/fastnetmon_juniper.php, la variable $IP_ATTACK (recibida de argv[1]) se interpola directamente en los comandos de configuración 'set' de Juniper NETCONF en las líneas 69 y 90 sin ninguna validación o saneamiento. Línea 69: $conn -> load_set_configuration("set routing-options static route {$IP_ATTACK} community 65535:666 discard"). Línea 90: $conn -> load_set_configuration("delete routing-options static route {$IP_ATTACK}/32"). Un atacante que puede controlar la cadena de la dirección IP puede inyectar comandos de configuración CLI de Juniper adicionales incrustando caracteres de nueva línea seguidos de comandos 'set'/'delete' arbitrarios. Esto podría modificar la tabla de enrutamiento del router, los filtros del cortafuegos, las cuentas de usuario o cualquier otro elemento de configuración accesible a través de NETCONF. El impacto es el compromiso total del router.

{"timestamp":"2026-05-26T20:27:27.425815Z","id":"CVE-2026-48694","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-77

OR
          *cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:* versions up to (including) 1.2.9

MITRE: https://github.com/pavel-odintsov/fastnetmon Types: Product

MITRE: https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection Types: Third Party Advisory

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE-78

FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commands at lines 69 and 90 without any validation or sanitization. Line 69: $conn->load_set_configuration("set routing-options static route {$IP_ATTACK} community 65535:666 discard"). Line 90: $conn->load_set_configuration("delete routing-options static route {$IP_ATTACK}/32"). An attacker who can control the IP address string can inject additional Juniper CLI configuration commands by embedding newline characters followed by arbitrary set/delete commands. This could modify the router's routing table, firewall filters, user accounts, or any other configuration element accessible via NETCONF. The impact is full router compromise.

https://github.com/pavel-odintsov/fastnetmon

https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection