CVE-2026-10870: Shibby Tomato 1.28.0000 OS Command Injection Vulnerability

Technical summary

CVE-2026-10870 is an OS command injection flaw in the start_dhcpc function within /sbin/rc, a critical component of Shibby Tomato's web UI. The vulnerability stems from insufficient input sanitization when processing DHCP configuration parameters. An authenticated attacker can inject shell metacharacters into function parameters, causing the shell interpreter to execute arbitrary commands with root-level privileges. The attack vector is network-based, requires high privileges (administrative credentials), and has no user interaction requirement. Both CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (OS Command Injection) classifications apply.

Business impact

Compromise of a Shibby Tomato router exposes both the device and downstream network to significant risk. An attacker gaining command execution can establish persistence, intercept traffic, modify DNS settings, deploy malware, or pivot to connected clients. For small office or SOHO deployments relying on Tomato-based routers, this could result in complete network compromise. Given that Shibby Tomato is a community fork of an older project and no longer under active development (superseded by FreshTomato), many instances may remain unpatched indefinitely, creating a persistent attack surface.

Affected systems

Shibby Tomato version 1.28.0000 is confirmed vulnerable. The Shibby Tomato project has been superseded by FreshTomato, which should be verified independently for patching status and exposure. Any router or embedded system running the vulnerable Shibby Tomato build is at risk. Organizations should audit their infrastructure for instances of this firmware, particularly in network edge devices, access points, or lab environments where custom router firmware may be deployed.

Exploitability

Exploitation requires valid administrative credentials to access the web UI, which raises the attack prerequisite bar compared to unauthenticated flaws. However, the presence of published exploit code, combined with the network-accessible attack surface and the prevalence of weak default credentials in home and small business routers, significantly elevates practical exploitability. An attacker who gains or already possesses admin credentials can reliably execute code without user interaction. The straightforward nature of command injection suggests reliable, repeatable exploitation.

Remediation

Immediate action is to discontinue use of Shibby Tomato 1.28.0000 if it remains deployed. The Shibby Tomato project is no longer maintained; the successor project FreshTomato should be evaluated and deployed as a replacement. Organizations should verify whether FreshTomato addresses this vulnerability before migration. For devices where upgrading is not immediately possible, restrict administrative access to trusted networks only, disable remote management, and implement network-level controls to limit lateral movement from a compromised router. Change default administrative credentials and disable any unnecessary services.

Patch guidance

No patch is available for Shibby Tomato 1.28.0000, as the project is superseded and no longer receives updates. Organizations should migrate to FreshTomato and verify through the FreshTomato project documentation that the vulnerability has been remediated in the target version. Consult FreshTomato's official release notes and security advisories to confirm patch versions address CVE-2026-10870. Test any firmware update in a non-production environment before deployment to production routers.

Detection guidance

Network-level detection is limited but should focus on monitoring administrative access to router web interfaces for anomalous activity or failed login attempts. System-level detection on the router itself is challenging without specialized logging. Organizations should enable access logs on web-based management interfaces if available, monitor for suspicious command patterns in syslog or shell history if accessible, and watch for unexpected process execution or child processes spawned from rc or web UI daemons. Intrusion detection signatures targeting command injection payloads in HTTP requests to Tomato web UI endpoints may catch exploitation attempts.

Why prioritize this

Although the CVSS score is 7.2 (HIGH), prioritization must account for the authentication requirement and the limited scope of Shibby Tomato deployment relative to mainstream router firmware. However, the project's end-of-life status, the availability of published exploits, and the likelihood of long-term non-patched deployments warrant urgent remediation within affected environments. Organizations running Shibby Tomato should treat this as critical within their own risk context, even if it does not rank as critical industry-wide.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects a HIGH severity rating driven by high confidentiality, integrity, and availability impact (root-level command execution) tempered by the requirement for high privilege level (authenticated admin access). The network attack vector and low complexity further support the score. This assessment assumes the attacker already possesses or can obtain administrative credentials; the practical risk is elevated where default credentials remain unchanged or where credential compromise is plausible.

Frequently asked questions