Which versions of Shibby Tomato are affected by CVE-2026-19035?

Shibby Tomato 1.28.0000 routers contain a remote command injection vulnerability exploitable by authenticated administrators; publicly available exploit code exists for this vulnerability.

Is there a public PoC exploit available for CVE-2026-19035?

Yes, a public proof-of-concept exploit is available for CVE-2026-19035. Prioritise patching immediately. EPSS: 2.5%.

How to fix or mitigate CVE-2026-19035?

Within 24 hours, conduct a network audit to identify all Shibby Tomato 1.28.0000 devices and immediately disable remote administrative access and restrict local administrative credentials to essential personnel only. Within 7 days, identify compatible alternative firmware options (FreshTomato or other supported alternatives) for the affected hardware platforms and conduct lab-based migration testing. Within 30 days, execute hardware replacement or firmware migration for all Shibby Tomato 1.28.0000 devices in production, verifying successful transitions before decommissioning legacy equipment.

Shibby Tomato CVE-2026-19035

Q: What is the CVSS score of CVE-2026-19035?

CVE-2026-19035 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.5%.

EUVD-2026-53867 HIGH

OS Command Injection (CWE-78)

2026-08-06 VulDB

GHSA-964g-j4xf-wqpj

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network vector confirmed, but PR:H required as admin credentials are prerequisite; scope unchanged as impact is confined to the router system itself.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Aug 06, 2026 - 12:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 12:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 06, 2026 - 12:21 vuln.today

CVE Published

Aug 06, 2026 - 11:30 cve.org

HIGH 7.3

DescriptionCVE.org

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operating system commands via the new_qoslimit_enable argument passed to the new_qoslimit_start function in /etc/qoslimit. Exploitation requires high-privilege (admin-level) credentials, but a proof-of-concept is publicly available on Gitee. The project has been officially superseded by FreshTomato, meaning no vendor patch is expected and affected devices will remain permanently unpatched.

Technical ContextAI

Shibby Tomato is a third-party open-source firmware for Broadcom-based consumer routers, with version 1.28.0000 identified in CPE cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*. The vulnerable code path is the new_qoslimit_start function in the /etc/qoslimit script, which handles Quality of Service (QoS) bandwidth limiting configuration. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates the root cause: user-supplied input to the new_qoslimit_enable parameter is passed to a shell command without sanitization, allowing shell metacharacters or command separators to break out of the intended command context and inject arbitrary OS commands executed with firmware-level privileges.

RemediationAI

No vendor-released patch is available and none is expected, as the Shibby Tomato project is officially superseded by FreshTomato. The primary remediation is firmware migration: replace Shibby Tomato with FreshTomato or another actively maintained router firmware if the hardware supports it, accepting the trade-off of configuration migration effort. If migration is not immediately feasible, disable remote WAN access to the router management interface (restricting it to LAN-only access eliminates the network-based attack vector). Change all default admin credentials to strong, unique passwords to raise the bar beyond the PR:H requirement. If the QoS/bandwidth limiting feature is not in active use, disable it entirely to reduce the attack surface - though this does not guarantee the vulnerable code is entirely unreachable. No official advisory URL exists from the original project vendor.