FastNetMon Community Edition through version 1.2.9 contains an OS command injection flaw in the MikroTik router integration plugin. The _log() routine builds a shell command by concatenating the $msg parameter directly into an exec() call. The $msg variable is populated from unfiltered command‑line arguments, creating a classic CWE‑78 vulnerability that allows an attacker who can influence argv[] values to inject arbitrary shell commands. Successful exploitation results in remote code execution with the privileges of the FastNetMon process, potentially giving full control over the host.

All deployments of FastNetMon Community Edition 1.2.9 or earlier that enable the MikroTik integration plugin are affected. The vulnerability resides in src/mikrotik_plugin/fastnetmon_mikrotik.php of the open‑source project hosted on GitHub by pavel‑odintsov. Versions released after 1.2.9 are believed to incorporate the fix and are not vulnerable.

The CVSS score of 8.1 indicates a high‑severity OS command injection. Exploitation requires the ability to modify command‑line arguments delivered to the FastNetMon process, which can be achieved locally or via any trusted input source that the process consumes. Once the attacker can inject commands, they run with the same privileges as the FastNetMon service, which may be root or otherwise privileged. The EPSS score of 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, but the impact and severity warrant immediate remediation.