FastNetMon Community Edition versions up to 1.2.9 contain an OS command injection flaw in the Juniper router integration plugin. The PHP _log() function builds shell commands by concatenating user‑supplied data directly into exec() calls without sanitization, allowing an attacker to inject arbitrary shell commands. If exploited, the attacker could execute any privilege‑baked command on the host, compromising confidentiality, integrity, and availability of the system.

FastNetMon Community Edition, including the Juniper integration plugin, is affected for all releases through version 1.2.9. The vulnerability is present in the PHP script located in src/juniper_plugin/fastnetmon_juniper.php and relies on command‑line inputs passed as argv[1] through argv[3].

The flaw enables arbitrary command execution, with a CVSS score of 8.1 indicating high severity. The likely attack vector is inferred from the description: the exec() call uses unsanitized input from argv[1]–[3], which can originate from external orchestrations or may be supplied directly to the script, suggesting local execution by a privileged or compromised user or remote exposure if the script is reachable from outside. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The absence of input validation and shell escaping makes exploitation straightforward for an attacker with access to the execution environment.