CVE-2026-10872: OS Command Injection in Shibby Tomato 1.28.0000 Web UI

Technical summary

CVE-2026-10872 is an OS command injection vulnerability (CWE-77, CWE-78) located in the start_vpnserver function within the /sbin/rc file, which handles Web UI operations in Shibby Tomato 1.28.0000. The vulnerability stems from insufficient input validation on user-supplied parameters that are passed to system commands without proper sanitization. An attacker must have high-level administrative privileges (PR:H) to trigger the flaw, but once exploited, can achieve unauthenticated code execution with full system permissions. The attack vector is network-based with low attack complexity.

Business impact

Successful exploitation enables complete compromise of affected routers. An administrator account (or attacker with stolen admin credentials) could execute arbitrary system commands, leading to data theft from devices behind the router, network traffic interception, lateral movement into connected networks, persistent backdoor installation, and device takeover. For organizations deploying Shibby Tomato in edge or branch office scenarios, this could create a critical network ingress point for attackers.

Affected systems

Shibby Tomato version 1.28.0000 is confirmed vulnerable. The project has been superseded by FreshTomato; users should verify whether FreshTomato versions contain similar code paths or have addressed this class of injection flaw. Organizations running legacy Shibby Tomato deployments—particularly in network appliance, routing, or edge computing roles—require immediate assessment.

Exploitability

The vulnerability carries a CVSS 3.1 score of 7.2 (HIGH) with a network attack vector and low attack complexity. The requirement for high-privilege administrative access (PR:H) restricts the initial attack surface, but public exploit information exists, lowering the technical barrier for actors who gain administrative credentials through phishing, social engineering, or credential compromise. The lack of user interaction required (UI:N) means automated exploitation is feasible once authentication is achieved.

Remediation

Shibby Tomato 1.28.0000 users should immediately cease use of this firmware and migrate to FreshTomato, the successor project. Verify that FreshTomato's current build does not inherit this vulnerability or similar input-validation weaknesses in the VPN server initialization code. Until migration is complete, restrict administrative access to the Web UI to trusted networks only, implement strong authentication controls, and monitor for suspicious command execution in system logs.

Patch guidance

No patch is available for Shibby Tomato 1.28.0000 because the project is no longer actively maintained. The only supported remediation is migration to FreshTomato. Download the latest stable FreshTomato release from the official repository and perform a clean flash. Verify the integrity of the firmware image using published checksums. After upgrade, reconfigure VPN settings and reset administrative credentials.

Detection guidance

Monitor Web UI access logs and process execution logs for suspicious patterns: unusual VPN server restart commands initiated through the Web UI, shell metacharacters (pipes, semicolons, backticks, command substitution syntax) in HTTP request parameters destined for the /sbin/rc handler, and unexpected system commands spawned by the Web UI process. Implement network segmentation to restrict administrative access to trusted subnets. Review authentication logs for successful admin logins from unexpected sources.

Why prioritize this

Despite the high CVSS score and public exploit availability, the requirement for high-privilege authentication limits this to organizations where Shibby Tomato is deployed in restricted administrative environments or where credential compromise is a real risk. However, because the project is unmaintained and the attack surface includes the Web UI (often accessible on local networks), this should be treated as urgent for any remaining deployments. The HIGH severity rating, combined with the imminent availability of weaponized proof-of-concept code, justifies rapid decommissioning of affected firmware.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects: (1) network-accessible attack vector; (2) low attack complexity, meaning no special tools or advanced knowledge required; (3) high-privilege requirement, reducing immediate risk from unauthenticated attackers; and (4) high impact across confidentiality, integrity, and availability—full system compromise is possible. The availability of public exploits and the unmaintained status of the project elevate real-world risk beyond the base CVSS score.

Frequently asked questions