Which versions of Shibby Tomato are affected by CVE-2026-19034?

Shibby Tomato 1.28.0000 router firmware contains a remote code execution vulnerability accessible to authenticated administrators, potentially allowing compromised or malicious admin accounts to gain…

Is there a public PoC exploit available for CVE-2026-19034?

Yes, a public proof-of-concept exploit is available for CVE-2026-19034. Prioritise patching immediately. EPSS: 2.5%.

How to fix or mitigate CVE-2026-19034?

Within 24 hours: Identify all routers running Shibby Tomato 1.28.0000 and immediately restrict administrative console access to a minimal set of trusted personnel; audit recent administrative account activity for unauthorized commands or configuration changes. Within 7 days: Establish a migration project to transition all affected routers to FreshTomato or an alternative actively maintained firmware; validate QoS configurations and backup device settings ahead of the upgrade. Within 30 days: Complete firmware migration on all identified systems, verify network functionality and QoS policies are operational on the new platform, and document the decommissioning of any systems that cannot be upgraded.

Shibby Tomato CVE-2026-19034

Q: What is the CVSS score of CVE-2026-19034?

CVE-2026-19034 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.5%.

EUVD-2026-53844 HIGH

OS Command Injection (CWE-78)

2026-08-06 VulDB

GHSA-p42c-v74f-mh4c

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-delivered but gated behind admin authentication (PR:H); trivial to execute once credentials are held; full CIA impact on the embedded router OS with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 11:37 vuln.today

CVSS changed

Aug 06, 2026 - 11:22 NVD

8.6 (HIGH) 7.3 (HIGH)

CVE Published

Aug 06, 2026 - 10:30 cve.org

HIGH 7.3

DescriptionCVE.org

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with administrative access to execute arbitrary operating system commands on the affected router. The vulnerable function new_qoslimit_stop in /tmp/qoslimittc_stop.sh accepts a wan_iface argument that is passed unsanitized into a shell command, yielding full system-level code execution. A public proof-of-concept advisory has been disclosed on Gitee; no vendor patch is expected because Shibby Tomato is end-of-life, formally superseded by FreshTomato.

Technical ContextAI

Shibby Tomato is a third-party open-source firmware for MIPS-based consumer routers (Asus RT series, Linksys, and similar devices), derived from the original Tomato project. The vulnerable code resides in the QoS (Quality of Service) traffic-shaping subsystem: the shell script /tmp/qoslimittc_stop.sh exposes a function new_qoslimit_stop that takes a wan_iface (WAN interface name) argument and interpolates it directly into a shell command without sanitization, a textbook CWE-78 (Improper Neutralization of Special Elements Used in an OS Command). Because router firmware of this class executes QoS management scripts as root, successful injection yields full privileged command execution on the embedded Linux OS. The CPE string cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:* carries no version floor, indicating all Shibby Tomato versions are potentially affected.

RemediationAI

No vendor-released patch exists and none is expected given the project's end-of-life status. The primary remediation is migration to an actively maintained router firmware - FreshTomato is the official successor to Shibby Tomato and eliminates the vulnerable codebase entirely; OpenWrt is a suitable alternative for supported hardware. For operators unable to migrate immediately, disable remote WAN-side administrative access on the router, restricting management interface reachability to trusted LAN segments only - this removes network-reachable exposure while PR:H still requires admin credentials. Blocking external access to management ports (typically TCP 80, 443, and 8080) via upstream firewall or ISP ACL is a viable short-term control but does not address insider or LAN-side risk. Ensure admin credentials are long, unique, and not set to factory defaults, as credential compromise is the necessary prerequisite for exploitation. Advisory reference: https://vuldb.com/vuln/386453.