Executive brief
FastNetMon is a DDoS detection tool used by network operators to identify and mitigate traffic attacks. A vulnerability in its MikroTik router integration allows attackers to execute unauthorized commands on the host system and potentially gain control over connected MikroTik routers using hardcoded default credentials. This could lead to service outages, unauthorized network configuration changes, or full system compromise.
Technical details
The MikroTik integration plugin (fastnetmon_mikrotik.php) contains two critical flaws. First, the _log() function performs unsanitized concatenation of the $msg parameter into an exec() call, allowing OS command injection if an attacker can influence command-line arguments (argv[]). Second, the plugin contains hardcoded default credentials (api/api123) for MikroTik router authentication. An attacker who can reach the router's API port (TCP/8728 or 8729) can use these credentials to modify router configurations, including firewall rules and routing tables. As of May 2026, no official patch has been released; users are advised to manually replace exec() with file_put_contents() and externalize credentials to a secure configuration file.
Affected products
- FastNetMon FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: disclosed: Vendor notified by Lorikeet Security
- 2026-05-23: advisory: Public advisory released by Lorikeet Security
- 2026-05-26: disclosed: CVE published to NVD