Which versions of Shibby Tomato are affected by CVE-2026-10870?

Shibby Tomato 1.28.0000 router firmware contains a remotely exploitable command injection vulnerability affecting users with administrative access.

Is there a public PoC exploit available for CVE-2026-10870?

Yes, a public proof-of-concept exploit is available for CVE-2026-10870. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10870?

Within 24 hours: Identify and inventory all Shibby Tomato 1.28.0000 devices in production; implement access controls and monitoring on administrative interfaces. Within 7 days: Evaluate and plan migration to FreshTomato (the successor project) or alternative actively-maintained router firmware. Within 30 days: Complete migration or decommissioning of affected devices; update asset inventory and document the remediation timeline.

Shibby Tomato CVE-2026-10870

Q: What is the CVSS score of CVE-2026-10870?

CVE-2026-10870 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34323 HIGH

OS Command Injection (CWE-78)

2026-06-04 VulDB

GHSA-pmrf-jcmc-23c7

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 04, 2026 - 21:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 04, 2026 - 21:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 04, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jun 04, 2026 - 21:22 NVD

7.2 (HIGH) 7.3 (HIGH)

Analysis Generated

Jun 04, 2026 - 21:15 vuln.today

DescriptionCVE.org

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_dhcpc function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists per the VulDB advisory. The project has been discontinued and superseded by FreshTomato, meaning no upstream fix from the original maintainer is expected.

Technical ContextAI

Shibby Tomato is a community-maintained, now-discontinued fork of the Tomato firmware used on consumer wireless routers (typically Broadcom-based devices). The vulnerable component is the start_dhcpc function in the /sbin/rc init/service binary, which is invoked by the Web UI when handling DHCP client configuration. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that user-supplied input - most likely NVRAM-stored configuration values consumed by the rc script - is concatenated into a shell command without sanitization, enabling command injection that runs with the privileges of the firmware's web/management process (typically root on embedded routers).

RemediationAI

No vendor-released patch identified at time of analysis - Shibby Tomato is a discontinued project superseded by FreshTomato, so administrators should migrate affected devices to FreshTomato (after independently verifying that FreshTomato has remediated the equivalent start_dhcpc code path) or replace the device with supported router firmware such as OpenWrt. Until migration, restrict the Web UI to trusted LAN segments only and ensure remote/WAN administration is disabled, which prevents internet-based reach to the vulnerable endpoint but does not stop an attacker who has already obtained LAN access or admin credentials. Rotate the router admin password to a strong unique value and audit any DHCP-client-related NVRAM fields for unexpected shell metacharacters; this reduces the chance an attacker with low-privileged LAN access can pivot to admin and trigger the bug. Reference advisories: https://vuldb.com/cve/CVE-2026-10870 and the disclosure at https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/01-start_dhcpc.md.