Which versions of Shibby Tomato are affected by CVE-2026-10871?

Organizations using Shibby Tomato 1.28.0000 routers face infrastructure compromise through command injection in Web UI authentication.

Is there a public PoC exploit available for CVE-2026-10871?

Yes, a public proof-of-concept exploit is available for CVE-2026-10871. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10871?

Within 24 hours: inventory all Shibby Tomato firmware instances and disable remote Web UI access via firewall rules. Within 7 days: source and validate FreshTomato (maintained successor) or alternative firmware for each affected device; coordinate hardware replacement if compatibility issues arise. Within 30 days: complete migration to FreshTomato or alternate maintained firmware for all affected routers, or implement persistent segmentation isolating routers from untrusted subnets.

Shibby Tomato CVE-2026-10871

Q: What is the CVSS score of CVE-2026-10871?

CVE-2026-10871 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34332 HIGH

OS Command Injection (CWE-78)

2026-06-04 VulDB

GHSA-c765-prxh-h25f

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 22:35 vuln.today

CVSS changed

Jun 04, 2026 - 22:22 NVD

7.2 (HIGH) 7.3 (HIGH)

DescriptionCVE.org

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary shell commands by manipulating the ipv6_6rd_borderrelay argument processed by the start_6rd_tunnel function in /sbin/rc via the Web UI. Publicly available exploit code exists per VulDB disclosure, and the project is end-of-life - superseded by FreshTomato - meaning no upstream fix is expected.

Technical ContextAI

Shibby Tomato is a community fork of the Tomato router firmware (Linux-based) historically used on Broadcom-based consumer routers, identified by CPE cpe:2.3:a:shibby:tomato:*. The vulnerability resides in /sbin/rc, the firmware's main runtime control binary, specifically in the start_6rd_tunnel routine that configures IPv6 Rapid Deployment (6rd) tunneling. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the ipv6_6rd_borderrelay NVRAM parameter - settable through the Web UI - is passed unsanitized into a shell command invocation, allowing shell metacharacter injection that the underlying BusyBox shell executes with the router's privileges.

RemediationAI

No vendor-released patch identified at time of analysis - Shibby Tomato is discontinued and superseded by FreshTomato, so the primary remediation is to migrate affected routers to FreshTomato (or another maintained firmware such as OpenWrt) which should be reviewed for the same code path before deployment. As compensating controls until migration, disable the IPv6 6rd tunnel feature in the Web UI to remove the vulnerable code path (side effect: loss of 6rd IPv6 connectivity for ISPs that depend on it), restrict Web UI access to trusted management VLANs or specific source IPs and ensure remote/WAN administration is disabled (side effect: admin must be on-LAN), and rotate the admin password to a strong unique value to make the required high-privilege precondition harder to satisfy. Consult the disclosure at https://gitee.com/WH-YHUST/tomato-rc-nvram-cve and VulDB entry https://vuldb.com/vuln/368361 for technical detail.