# CVE-2026-48695: FastNetMon OS command injection and hardcoded credentials in MikroTik plugin

Source: https://junglewise.ai/threats/cve-2026-48695-fastnetmon-os-command-injection-and-hardcoded-credentials-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-48695 · Severity: info · CVSS 8.1 · Published 2026-05-26

FastNetMon is a DDoS detection tool used by network operators to identify and mitigate traffic attacks. A vulnerability in its MikroTik router integration allows attackers to execute unauthorized commands on the host system and potentially gain control over connected MikroTik routers using hardcoded default credentials. This could lead to service outages, unauthorized network configuration changes, or full system compromise.

## Quick answers

**Is CVE-2026-48695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48695 being exploited in the wild.

**How severe is CVE-2026-48695?** Informational severity, with a CVSS score of 8.1, published 26 May 2026.

**Which products and versions are affected?** FastNetMon FastNetMon Community Edition through 1.2.9.

**Is there a fix for CVE-2026-48695?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-48695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48695?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MikroTik integration plugin (fastnetmon_mikrotik.php) contains two critical flaws. First, the _log() function performs unsanitized concatenation of the $msg parameter into an exec() call, allowing OS command injection if an attacker can influence command-line arguments (argv[]). Second, the plugin contains hardcoded default credentials (api/api123) for MikroTik router authentication. An attacker who can reach the router's API port (TCP/8728 or 8729) can use these credentials to modify router configurations, including firewall rules and routing tables. As of May 2026, no official patch has been released; users are advised to manually replace exec() with file_put_contents() and externalize credentials to a secure configuration file.

## Affected products

- FastNetMon FastNetMon Community Edition through 1.2.9

## Timeline

- 2026-04-25: disclosed: Vendor notified by Lorikeet Security
- 2026-05-23: advisory: Public advisory released by Lorikeet Security
- 2026-05-26: disclosed: CVE published to NVD

## References

- [https://github.com/pavel-odintsov/fastnetmon](https://github.com/pavel-odintsov/fastnetmon)
- [https://github.com/pavel-odintsov/fastnetmon/blob/master/src/mikrotik_plugin/fastnetmon_mikrotik.php](https://github.com/pavel-odintsov/fastnetmon/blob/master/src/mikrotik_plugin/fastnetmon_mikrotik.php)
- [https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48695-mikrotik-cmd-injection](https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48695-mikrotik-cmd-injection)