EUVD-2026-34339
GHSA-f2p9-c2rc-cj7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.
AnalysisAI
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_vpnserver function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - meaning no upstream patch is forthcoming. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must possess valid administrator credentials for the Shibby Tomato Web UI (CVSS PR:H), and the router's management interface must be network-reachable from the attacker - either via LAN access or because WAN-side remote administration has been enabled on the device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and point to a real but bounded risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained Tomato Web UI administrator credentials - through phishing, credential reuse against an exposed WAN management interface, or a default/weak password on a consumer router - logs in and submits a crafted VPN server configuration value containing shell metacharacters. When the firmware invokes start_vpnserver in /sbin/rc, the injected payload executes as root, allowing the attacker to install persistent backdoors, pivot into the LAN, or weaponize the router for botnet/proxy use. … |
| Remediation | No vendor-released patch identified at time of analysis - the Shibby Tomato project is end-of-life and superseded by FreshTomato, so the primary remediation is migration to FreshTomato (after verifying with that project's maintainers that the start_vpnserver code path has been fixed or audited) or replacement of affected hardware with a currently supported router firmware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all Shibby Tomato 1.28.0000 deployments and restrict Web UI administrative access via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today