A security flaw has been identified in FastNetMon Community Edition, affecting all versions up to 1.2.9, specifically in its Juniper router integration plugin. This is an OS command injection vulnerability, meaning unsanitized data passed to the plugin's logging script could be used to run unauthorized, potentially malicious commands on the server running the software. The issue stems from the plugin's logging function, which builds system commands by inserting unvetted input (such as attack IP addresses, traffic direction, and power data) directly into command calls without cleaning it first. While the core FastNetMon software currently passes IP addresses in a safe, standard format that can't be exploited, if the plugin script is run on its own, connected to another external system, or if future software updates change how data is sent to the plugin, an attacker could inject malicious commands to take control of the server. If you use FastNetMon Community Edition 1.2.9 or earlier with the Juniper router integration feature enabled, this flaw could allow unauthorized server access, disruption of your hosted websites and services, or theft of data stored on the server. The official fix involves updating the plugin code to either avoid using system command execution for logging, or to properly sanitize all input before it is used in system commands.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-48687