FastNetMon Community Edition versions up to 1.2.9 include an OS command injection flaw in the Juniper router integration plugin. The PHP _log() function builds shell commands by concatenating user‑supplied data directly into exec() calls without sanitization, allowing an attacker to inject arbitrary shell commands. If exploited, the attacker could execute any privilege‑baked command on the host, compromising confidentiality, integrity, and availability of the system.

FastNetMon Community Edition, including the Juniper integration plugin, is affected for all releases through version 1.2.9. The vulnerability is present in the PHP script located in src/juniper_plugin/fastnetmon_juniper.php and relies on command‑line inputs passed as argv[1] through argv[3].

The flaw enables arbitrary command execution, which is a high‑impact exploitation. Since the PHP script can be invoked directly or by orchestration systems, the attack vector is both local and potentially remote if the script is exposed. The vulnerability does not appear in the CISA KEV catalog and no EPSS score is available, but the absence of input validation and shell escaping makes exploitation straightforward for an attacker with access to the execution environment.