CVE-2026-48687 is an OS command injection vulnerability in FastNetMon Community Edition (≤1.2.9) within the Juniper router integration plugin. The vulnerability exists in the _log() function of src/juniper_plugin/fastnetmon_juniper.php, where the $msg parameter, derived from command-line arguments representing attack IP, direction, and power, is concatenated directly into an exec() shell command without sanitization or escaping. While the current C++ core ensures IP addresses are safely formatted, the PHP script does not validate or escape inputs, enabling potential arbitrary command execution if the script is invoked directly or future code changes introduce string-sourced IPs. The recommended fix is to replace exec() calls with safer alternatives like file_put_contents() or to properly escape shell arguments using escapeshellarg(). No official patch or vendor advisory is available at this time.

Successful exploitation could allow an attacker with local or limited privileges to execute arbitrary OS commands on the system running FastNetMon's Juniper plugin PHP script. This could lead to compromise of confidentiality and integrity of the affected system. The CVSS 3.1 base score is 8.1 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity. Availability impact is not affected. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid invoking the vulnerable PHP script directly with untrusted input. Review any orchestration or automation systems that call this script to ensure they do not pass unsanitized or user-controlled data. Consider code review and applying manual mitigations such as replacing exec() calls with safer functions like file_put_contents() or applying proper shell argument escaping (e.g., escapeshellarg()) if you maintain the codebase.