The FastNetMon Community Edition (up to 1.2.9) MikroTik plugin's _log() function constructs shell commands by concatenating the $msg parameter directly into exec() calls without sanitization. This allows an attacker who can influence command-line arguments to inject arbitrary OS commands, leading to command injection. The vulnerability is due to improper input handling in the PHP code, specifically in src/mikrotik_plugin/fastnetmon_mikrotik.php around lines 107-108. The recommended fix is to replace exec() usage with safer alternatives like file_put_contents() or to sanitize inputs using escapeshellarg().

Successful exploitation allows an attacker with the ability to influence command-line arguments to execute arbitrary shell commands on the host running FastNetMon, potentially leading to system compromise or unauthorized actions. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid running FastNetMon versions up to 1.2.9 with the MikroTik plugin enabled in environments where untrusted users can influence command-line arguments. Monitoring vendor channels for updates is recommended. The vendor suggests replacing exec() calls with safer functions like file_put_contents() or sanitizing inputs with escapeshellarg(), but no official patch is currently documented.