Which versions of Shibby Tomato are affected by CVE-2026-19036?

Shibby Tomato 1.28.0000 deployments face an immediate risk: publicly available exploit code exists for a command injection vulnerability that permits network-connected administrators to execute…

Is there a public PoC exploit available for CVE-2026-19036?

Yes, a public proof-of-concept exploit is available for CVE-2026-19036. Prioritise patching immediately. EPSS: 2.5%.

How to fix or mitigate CVE-2026-19036?

Within 24 hours, inventory all Shibby Tomato 1.28.0000 instances across your infrastructure to quantify exposure and identify network-critical systems. Within 7 days, obtain FreshTomato firmware, plan the upgrade sequence prioritizing business-critical network segments, and conduct testing in a staging environment to validate configuration compatibility. Within 30 days, execute the complete firmware migration across all affected routers, verify post-upgrade functionality, and retire or air-gap any systems that cannot be upgraded.

Shibby Tomato CVE-2026-19036

Q: What is the CVSS score of CVE-2026-19036?

CVE-2026-19036 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.5%.

EUVD-2026-53868 HIGH

OS Command Injection (CWE-78)

2026-08-06 VulDB

GHSA-v799-m875-3q84

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Admin credentials required (PR:H); network-accessible admin panel (AV:N); command injection escapes to underlying Linux OS crossing scope boundary (S:C); full confidentiality, integrity, and availability impact on router system.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 13:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 13:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 13:22 NVD

8.6 (HIGH) 7.3 (HIGH)

Analysis Generated

Aug 06, 2026 - 13:21 vuln.today

CVE Published

Aug 06, 2026 - 12:00 cve.org

HIGH 8.6

DescriptionCVE.org

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell commands on the underlying router Linux OS. The vulnerability resides in function sub_40F88C, which passes the ppp_custom argument from /tmp/ppp/wanoptions into a system call without sanitizing shell metacharacters. A public proof-of-concept exploit is available on Gitee, and because this project is abandoned - officially superseded by FreshTomato - no patch will be released, making affected deployments permanently vulnerable without firmware migration.

Technical ContextAI

Shibby Tomato is a third-party Linux-based firmware for Broadcom Wi-Fi routers, forked from the original Tomato project. The affected component is the PPP WAN option processor: function sub_40F88C reads the /tmp/ppp/wanoptions configuration file and forwards the ppp_custom field to an OS-level command without filtering metacharacters such as semicolons or backticks, constituting CWE-78 (Improper Neutralization of Special Elements Used in an OS Command). On embedded Linux router firmware, PPP configuration processing typically runs with root or near-root privileges, meaning successful injection results in full system compromise. The CPE cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:* identifies the affected product line, with EUVD-2026-53868 narrowing the confirmed affected release to version 1.28.0000. The project has no active maintainer.

RemediationAI

No vendor-released patch identified at time of analysis - the Shibby Tomato project is abandoned and will receive no security fixes. The primary remediation is to migrate the affected router to an actively maintained firmware alternative such as FreshTomato, OpenWrt, or DD-WRT, if supported hardware allows. Until migration is complete, immediately disable remote (WAN-side) management access to the router's administrative interface and restrict it to trusted LAN segments only - this removes the network vector for external attackers but does not protect against compromised or malicious LAN users with admin credentials. Rotate all router administrative credentials and avoid use of default passwords. If the PPP/WAN custom options field can be left blank or is not required for the network configuration, clearing the ppp_custom field eliminates the injection point. These are compensating controls only; the underlying unpatched code remains vulnerable. Advisory reference: https://vuldb.com/vuln/386455.