Is there a public PoC exploit available for CVE-2026-15546?

Yes, a public proof-of-concept exploit is available for CVE-2026-15546. Prioritise patching immediately. EPSS: 1.1%.

Shibby Tomato CVE-2026-15546

Q: What is the CVSS score of CVE-2026-15546?

CVE-2026-15546 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-43314 LOW

OS Command Injection (CWE-78)

2026-07-13 VulDB

GHSA-pmqw-wcwq-2pqr

Command Injection Tomato Shibby

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

OS command injection on firmware yields full system control (C:H/I:H/A:H); PR:L confirmed by CVSS 4.0 vector; no scope change as impact is contained to the router itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 09:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 09:04 vuln.today

CVE Published

Jul 13, 2026 - 08:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the jffs2_exec argument in the start_jffs2 component's sub_2D568 function. A publicly available proof-of-concept exploit exists on Gitee, confirming exploitability beyond theoretical analysis. The project is officially abandoned and superseded by FreshTomato, meaning no vendor patch will ever be released - remediation requires migrating to supported firmware.

Technical ContextAI

Shibby Tomato is a third-party open-source firmware for consumer routers (Asus, Netgear, Linksys) derived from the Tomato firmware project, running an embedded Linux stack. The vulnerable component, start_jffs2, handles initialization of JFFS2 (Journaling Flash File System 2), a filesystem designed for NOR/NAND flash memory common in embedded router hardware. The function sub_2D568 within this component fails to sanitize the jffs2_exec argument before passing it to an OS-level command execution context, constituting a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw. The CPE cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:* covers all released versions, confirming no version of this codebase was ever patched. CWE-78 flaws in firmware management interfaces are particularly dangerous because the underlying OS runs with elevated privileges and there is typically no sandboxing between the web management layer and system commands.

RemediationAI

No patch will be released by the Shibby Tomato project as it is officially abandoned. The primary and recommended remediation is to migrate to FreshTomato (the direct successor project) or another actively maintained router firmware such as OpenWrt or DD-WRT, which receive ongoing security updates. If immediate firmware replacement is not feasible, apply the following compensating controls: disable remote (WAN-side) web management access entirely to prevent internet-exposed exploitation, restricting management to LAN-only with access limited to trusted administrator hosts via firewall ACLs; disable JFFS2 functionality in the router settings if not operationally required, which removes the vulnerable code path from the attack surface at the cost of losing JFFS2-dependent features such as custom scripts and persistent storage across reboots; place the router behind a perimeter firewall that blocks external access to management ports (typically TCP 80/443/8080). These workarounds reduce attack surface but do not eliminate the underlying flaw. The POC referenced at https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5O should be reviewed by defenders to understand exact exploitation conditions.