CVE-2026-48694 affects FastNetMon Community Edition through 1.2.9 in the Juniper router integration plugin. The vulnerability is due to unsanitized interpolation of the $IP_ATTACK variable into Juniper NETCONF set-configuration commands in the PHP source file fastnetmon_juniper.php. Specifically, the variable is used at lines 69 and 90 to construct commands that set or delete static routes. Because the input is not validated, an attacker can inject newline characters and additional Juniper CLI commands, enabling arbitrary configuration changes on the router. This can lead to full router compromise. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an attacker with the ability to control the IP address input to inject arbitrary Juniper CLI configuration commands via NETCONF. This can result in modification of the router's routing table, firewall filters, user accounts, or any other configurable element accessible through NETCONF. The impact is a full compromise of the router's configuration, potentially leading to unauthorized network control and data interception or disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the FastNetMon Juniper integration plugin and validate or sanitize inputs controlling the $IP_ATTACK variable to prevent injection. Monitor for unusual configuration changes on affected routers. Avoid exposing this functionality to untrusted users or networks.