Which versions of Shibby Tomato are affected by CVE-2026-10873?

Shibby Tomato 1.28.0000 router firmware contains a command injection vulnerability (CVE-2026-10873, CVSS 7.3) with publicly available exploit code that requires authentication and elevated privileges…

Is there a public PoC exploit available for CVE-2026-10873?

Yes, a public proof-of-concept exploit is available for CVE-2026-10873. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-10873?

Within 24 hours: Audit all deployments of Shibby Tomato 1.28.0000 and restrict Web UI access to trusted administrative networks. Within 7 days: Implement network segmentation limiting authenticated access to the router management interface; document all systems for migration. Within 30 days: Complete migration to FreshTomato or actively maintained alternative.

Shibby Tomato CVE-2026-10873

Q: What is the CVSS score of CVE-2026-10873?

CVE-2026-10873 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-34340 HIGH

OS Command Injection (CWE-78)

2026-06-04 VulDB

GHSA-87h4-4j7r-7jc2

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 04, 2026 - 23:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 04, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 04, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jun 04, 2026 - 23:22 NVD

7.2 (HIGH) 7.3 (HIGH)

Analysis Generated

Jun 04, 2026 - 23:01 vuln.today

DescriptionCVE.org

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary operating system commands by manipulating input to the rstats_path function within the /bin/rstats binary exposed via the Web UI. Publicly available exploit code exists per the Gitee advisory disclosed through VulDB, and the affected project is end-of-life - superseded by FreshTomato - meaning no upstream vendor patch is forthcoming. CVSS 4.0 base score is 7.3 with high privileges required but high confidentiality, integrity, and availability impact on the router.

Technical ContextAI

Shibby Tomato is a community-maintained fork of the Tomato firmware for consumer/SOHO routers, providing a Web UI for administering NVRAM-backed configuration. The vulnerable component, /bin/rstats, is the bandwidth/traffic statistics daemon, and its rstats_path handler reads a configuration value (likely from NVRAM) that is passed to a shell or system() call without adequate sanitization - the canonical CWE-78 (Improper Neutralization of Special Elements used in an OS Command) pattern common to embedded router firmware where shell metacharacters in user-controllable NVRAM variables are concatenated into command strings. Affected CPE is cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*, indicating all versions of the Shibby Tomato distribution are in scope, with the disclosure specifically referencing 1.28.0000.

RemediationAI

No vendor-released patch identified at time of analysis - the Shibby Tomato project is no longer maintained and has been superseded by FreshTomato, so the primary recommended remediation is to migrate affected devices to a currently maintained successor firmware such as FreshTomato (https://www.freshtomato.org/) after verifying the rstats handling has been fixed there, or to OpenWrt as an alternative. As a compensating control until migration, restrict Web UI access to a trusted management VLAN/IP allowlist via the router's Access Restrictions and disable WAN-side administration (trade-off: loses remote admin convenience); rotate the admin password and disable any shared/default credentials to enforce the PR:H prerequisite. Optionally disable the bandwidth monitoring (rstats) feature in the Web UI if not required (trade-off: loses traffic reporting), which removes the attack surface for this specific path. Consult the disclosure at https://vuldb.com/vuln/368363 for indicators and the technical writeup at the Gitee advisory linked above.