CVE-2026-48694 describes a configuration injection vulnerability in FastNetMon Community Edition (up to 1.2.9) within the Juniper router integration plugin. The vulnerability occurs because the $IP_ATTACK variable, sourced from argv[1], is directly interpolated into Juniper NETCONF commands at two points in the code (lines 69 and 90) without any input validation or sanitization. This allows an attacker who can control the IP address input to inject additional Juniper CLI configuration commands by embedding newline characters and arbitrary set/delete commands. Exploitation can lead to unauthorized modification of router configurations, including routing tables, firewall filters, and user accounts, resulting in full router compromise. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary Juniper CLI configuration commands on the targeted router via the FastNetMon Juniper plugin. This can lead to unauthorized changes to routing tables, firewall filters, user accounts, or other critical router settings, effectively resulting in full compromise of the router's configuration and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid exposing the vulnerable Juniper integration plugin to untrusted input or restrict access to trusted sources only. Input validation or sanitization should be implemented to prevent injection of arbitrary commands. Monitor vendor channels for updates or patches addressing this vulnerability.