{"id":"CVE-2026-48694","details":"FastNetMon Community Edition through 1.2.9 contains a configuration injection vulnerability in the Juniper router integration plugin. In src/juniper_plugin/fastnetmon_juniper.php, the $IP_ATTACK variable (received from argv[1]) is directly interpolated into Juniper NETCONF set-configuration commands at lines 69 and 90 without any validation or sanitization. Line 69: $conn-\u003eload_set_configuration(\"set routing-options static route {$IP_ATTACK} community 65535:666 discard\"). Line 90: $conn-\u003eload_set_configuration(\"delete routing-options static route {$IP_ATTACK}/32\"). An attacker who can control the IP address string can inject additional Juniper CLI configuration commands by embedding newline characters followed by arbitrary set/delete commands. This could modify the router's routing table, firewall filters, user accounts, or any other configuration element accessible via NETCONF. The impact is full router compromise.","modified":"2026-06-18T03:56:42.626022785Z","published":"2026-05-26T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48694.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48694.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48694"},{"type":"PACKAGE","url":"https://github.com/pavel-odintsov/fastnetmon"},{"type":"ARTICLE","url":"https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48694-juniper-netconf-injection"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pavel-odintsov/fastnetmon","events":[{"introduced":"0"},{"fixed":"394fbe06d112f9609d3d1cb10d60cbf98347c96a"}],"database_specific":{"source":["DESCRIPTION","CPE_RANGE"],"extracted_events":[{"introduced":"0"},{"fixed":"1.2.9"},{"introduced":"0"},{"last_affected":"1.2.9"}],"cpe":"cpe:2.3:a:pavel-odintsov:fastnetmon:*:*:*:*:community:*:*:*"}}],"versions":["v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.9","v1.1.8","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48694.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}