Is there a public PoC exploit available for CVE-2026-15547?

Yes, a public proof-of-concept exploit is available for CVE-2026-15547. Prioritise patching immediately. EPSS: 1.1%.

Shibby Tomato CVE-2026-15547

Q: What is the CVSS score of CVE-2026-15547?

CVE-2026-15547 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-43317 LOW

OS Command Injection (CWE-78)

2026-07-13 VulDB

GHSA-fv5c-8924-mvcw

Command Injection Tomato Shibby

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

OS command injection on router firmware yields full device compromise; PR:L reflects required low-privilege auth confirmed by CVSS 4.0 input vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 09:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 09:05 vuln.today

CVE Published

Jul 13, 2026 - 08:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulation of the argument cifs1/cifs2 can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrary commands on the underlying router OS by manipulating the cifs1 or cifs2 arguments passed to the CIFS Mount Handler function sub_2D048. A publicly available proof-of-concept exploit exists on Gitee, lowering the barrier to exploitation. The risk is compounded by the fact that Shibby Tomato is an end-of-life project with no active maintenance, superseded by FreshTomato, meaning no patch is forthcoming from the original vendor.

Technical ContextAI

Shibby Tomato is a third-party Linux-based firmware for SOHO routers, forked from the original Tomato project. The affected component is the CIFS (Common Internet File System) Mount Handler, responsible for configuring network share mounts on the router. The vulnerable function sub_2D048 processes user-supplied parameters cifs1 and cifs2 without adequate sanitization before passing them to a system shell call, instantiating CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The CPE cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:* covers all tracked versions up through 1.28.0000. Because the underlying OS is Linux-based router firmware, successful command injection typically runs in a highly privileged context.

RemediationAI

No patch will be released for Shibby Tomato as the project is end-of-life and superseded by FreshTomato; the primary remediation is to migrate to FreshTomato or another actively maintained firmware (e.g., OpenWRT, DD-WRT) that receives security updates. Until migration is possible, restrict access to the router web administration interface by disabling remote (WAN-side) management and limiting LAN-side access to trusted hosts only - this raises the effective attack bar from PR:L/AV:N to a local-only attack surface. Disabling the CIFS mount feature entirely via the router UI eliminates the vulnerable code path directly, with the trade-off of losing network share mounting functionality. Strong, unique administrative passwords reduce risk from credential-guessing attacks that could satisfy the low-privilege authentication requirement.