Which versions of Shibby Tomato are affected by EUVD-2026-34339?

Organizations using end-of-life Shibby Tomato 1.28.0000 routers face critical risk: authenticated attackers with administrative credentials can inject arbitrary operating system commands through the…

Is there a public PoC exploit available for EUVD-2026-34339?

Yes, a public proof-of-concept exploit is available for EUVD-2026-34339. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-34339?

24 hours: Identify all Shibby Tomato 1.28.0000 deployments and restrict Web UI administrative access via firewall rules. 7 days: Evaluate migration timeline to FreshTomato (the successor firmware project) or alternative router solutions. 30 days: Complete migration to FreshTomato or alternative firmware, or implement additional network segmentation and access controls if migration extends beyond this date.

Shibby Tomato EUVD-2026-34339

Q: What is the CVSS score of EUVD-2026-34339?

EUVD-2026-34339 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-10872 HIGH

OS Command Injection (CWE-78)

2026-06-04 VulDB

GHSA-f2p9-c2rc-cj7w

Command Injection Tomato Shibby

7.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 04, 2026 - 23:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 04, 2026 - 23:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 04, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jun 04, 2026 - 23:22 NVD

7.2 (HIGH) 7.3 (HIGH)

Analysis Generated

Jun 04, 2026 - 23:02 vuln.today

DescriptionCVE.org

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

AnalysisAI

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_vpnserver function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - meaning no upstream patch is forthcoming. The CVSS 4.0 score of 7.3 reflects high impact on confidentiality, integrity, and availability, but high privileges are required to trigger the flaw.

Technical ContextAI

Shibby Tomato is a community fork of the Tomato router firmware (a Linux-based replacement for stock firmware on Broadcom-chipset consumer routers such as Asus, Linksys, and Netgear devices), identified by the CPE cpe:2.3:a:shibby:tomato. The vulnerable code path lives in /sbin/rc - the multi-call init/control binary that dispatches service start/stop routines based on NVRAM configuration values. The start_vpnserver function reads attacker-influenced NVRAM parameters set via the Web UI and passes them into a shell context without sufficient sanitization, the classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) root cause. Because /sbin/rc runs as root on Tomato derivatives, successful injection yields root-level command execution on the router.

RemediationAI

No vendor-released patch identified at time of analysis - the Shibby Tomato project is end-of-life and superseded by FreshTomato, so the primary remediation is migration to FreshTomato (after verifying with that project's maintainers that the start_vpnserver code path has been fixed or audited) or replacement of affected hardware with a currently supported router firmware. As compensating controls until migration, disable the OpenVPN/PPTP server functionality in the Web UI so the start_vpnserver code path is not invoked (trade-off: loss of VPN server capability), restrict Web UI access to a hardened management VLAN and explicitly disable WAN-side remote administration (trade-off: no remote admin from outside the LAN), enforce strong unique admin passwords to make the PR:H precondition harder to satisfy, and place the router management interface behind an ACL allowing only specific trusted source IPs. Disclosure details and exploit references are at https://vuldb.com/cve/CVE-2026-10872 and the Gitee advisory linked above.