Shibby

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-19034	OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with administrative access to execute arbitrary operating system commands on the affected router. The vulnerable function new_qoslimit_stop in /tmp/qoslimittc_stop.sh accepts a wan_iface argument that is passed unsanitized into a shell command, yielding full system-level code execution. A public proof-of-concept advisory has been disclosed on Gitee; no vendor patch is expected because Shibby Tomato is end-of-life, formally superseded by FreshTomato.	HIGH	7.3	2.5%	59	PoC No patch
CVE-2026-19035	OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operating system commands via the `new_qoslimit_enable` argument passed to the `new_qoslimit_start` function in `/etc/qoslimit`. Exploitation requires high-privilege (admin-level) credentials, but a proof-of-concept is publicly available on Gitee. The project has been officially superseded by FreshTomato, meaning no vendor patch is expected and affected devices will remain permanently unpatched.	HIGH	7.3	2.5%	59	PoC No patch
CVE-2026-19036	OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell commands on the underlying router Linux OS. The vulnerability resides in function sub_40F88C, which passes the ppp_custom argument from /tmp/ppp/wanoptions into a system call without sanitizing shell metacharacters. A public proof-of-concept exploit is available on Gitee, and because this project is abandoned - officially superseded by FreshTomato - no patch will be released, making affected deployments permanently vulnerable without firmware migration.	HIGH	7.3	2.5%	59	PoC No patch
CVE-2026-10124	Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt memory in the ripd daemon via the rip_zebra_read_ipv4 function in the Zserv Handler component. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - so no vendor patch will be released. CVSS 4.0 score of 7.4 reflects network attack vector with low complexity but requires low-privilege access (PR:L) per the vector.	HIGH	7.4	0.0%	57	PoC No patch
CVE-2026-15544	Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the getupsvar function in the apcupsd CGI handler (www/apcupsd/tomatodata.cgi) fails to bound the Field argument, producing a stack-based buffer overflow (CWE-121). A logged-in user can send a crafted request to corrupt the stack and hijack control flow with full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (VulDB), though there is no evidence of active exploitation; the CVSS 4.0 score is 8.7 with an E:P (proof-of-concept) exploit-maturity flag.	HIGH	7.4	0.4%	57	PoC No patch
CVE-2026-15545	Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated remote users corrupt memory through the apcupsd web component. The flaw sits in the main() function of www/apcupsd/tomatodata.cgi, where crafted input reaches an out-of-bounds write (CWE-787) that can crash the CGI or potentially execute code on the router. Publicly available exploit code exists (via VulDB/Gitee), but there is no confirmed active exploitation; note that this project has been superseded by FreshTomato and is effectively end-of-life.	HIGH	7.4	0.4%	57	PoC No patch
CVE-2026-10870	OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_dhcpc function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists per the VulDB advisory. The project has been discontinued and superseded by FreshTomato, meaning no upstream fix from the original maintainer is expected.	HIGH	7.3	0.1%	57	PoC No patch
CVE-2026-10871	OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary shell commands by manipulating the ipv6_6rd_borderrelay argument processed by the start_6rd_tunnel function in /sbin/rc via the Web UI. Publicly available exploit code exists per VulDB disclosure, and the project is end-of-life - superseded by FreshTomato - meaning no upstream fix is expected.	HIGH	7.3	0.1%	57	PoC No patch
CVE-2026-10872	OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_vpnserver function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - meaning no upstream patch is forthcoming. The CVSS 4.0 score of 7.3 reflects high impact on confidentiality, integrity, and availability, but high privileges are required to trigger the flaw.	HIGH	7.3	0.1%	57	PoC No patch
CVE-2026-10873	OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary operating system commands by manipulating input to the rstats_path function within the /bin/rstats binary exposed via the Web UI. Publicly available exploit code exists per the Gitee advisory disclosed through VulDB, and the affected project is end-of-life - superseded by FreshTomato - meaning no upstream vendor patch is forthcoming. CVSS 4.0 base score is 7.3 with high privileges required but high confidentiality, integrity, and availability impact on the router.	HIGH	7.3	0.1%	57	PoC No patch
CVE-2026-16096	Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.	HIGH	8.7	0.4%	44	No patch
CVE-2026-16095	Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.	HIGH	8.7	0.4%	44	No patch
CVE-2026-15548	Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, low-privileged attacker to corrupt the stack of the embedded web server (/usr/sbin/httpd) via the DNS List Rendering function sub_407220, potentially achieving arbitrary code execution on the router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low-level authentication (PR:L) to the web administration interface. VulDB assigns an exploit maturity of Proof-of-Concept, meaning publicly available exploit code exists, though it is not listed in CISA KEV and no active exploitation is confirmed. Notably, the Tomato project by Shibby is discontinued and superseded by FreshTomato, so no first-party fix is expected.	HIGH	7.4	0.7%	38	No patch
CVE-2026-15546	OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the jffs2_exec argument in the start_jffs2 component's sub_2D568 function. A publicly available proof-of-concept exploit exists on Gitee, confirming exploitability beyond theoretical analysis. The project is officially abandoned and superseded by FreshTomato, meaning no vendor patch will ever be released - remediation requires migrating to supported firmware.	LOW	2.1	1.1%	30	PoC No patch
CVE-2026-15547	OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrary commands on the underlying router OS by manipulating the cifs1 or cifs2 arguments passed to the CIFS Mount Handler function sub_2D048. A publicly available proof-of-concept exploit exists on Gitee, lowering the barrier to exploitation. The risk is compounded by the fact that Shibby Tomato is an end-of-life project with no active maintenance, superseded by FreshTomato, meaning no patch is forthcoming from the original vendor.	LOW	2.1	1.1%	30	PoC No patch

CVE-2026-19034

OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with administrative access to execute arbitrary operating system commands on the affected router. The vulnerable function new_qoslimit_stop in /tmp/qoslimittc_stop.sh accepts a wan_iface argument that is passed unsanitized into a shell command, yielding full system-level code execution. A public proof-of-concept advisory has been disclosed on Gitee; no vendor patch is expected because Shibby Tomato is end-of-life, formally superseded by FreshTomato.

HIGH

7.3

2.5%

59

PoC No patch

CVE-2026-19035

OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operating system commands via the `new_qoslimit_enable` argument passed to the `new_qoslimit_start` function in `/etc/qoslimit`. Exploitation requires high-privilege (admin-level) credentials, but a proof-of-concept is publicly available on Gitee. The project has been officially superseded by FreshTomato, meaning no vendor patch is expected and affected devices will remain permanently unpatched.

HIGH

7.3

2.5%

59

PoC No patch

CVE-2026-19036

OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell commands on the underlying router Linux OS. The vulnerability resides in function sub_40F88C, which passes the ppp_custom argument from /tmp/ppp/wanoptions into a system call without sanitizing shell metacharacters. A public proof-of-concept exploit is available on Gitee, and because this project is abandoned - officially superseded by FreshTomato - no patch will be released, making affected deployments permanently vulnerable without firmware migration.

HIGH

7.3

2.5%

59

PoC No patch

CVE-2026-10124

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt memory in the ripd daemon via the rip_zebra_read_ipv4 function in the Zserv Handler component. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - so no vendor patch will be released. CVSS 4.0 score of 7.4 reflects network attack vector with low complexity but requires low-privilege access (PR:L) per the vector.

HIGH

7.4

0.0%

57

PoC No patch

CVE-2026-15544

Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the getupsvar function in the apcupsd CGI handler (www/apcupsd/tomatodata.cgi) fails to bound the Field argument, producing a stack-based buffer overflow (CWE-121). A logged-in user can send a crafted request to corrupt the stack and hijack control flow with full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (VulDB), though there is no evidence of active exploitation; the CVSS 4.0 score is 8.7 with an E:P (proof-of-concept) exploit-maturity flag.

HIGH

7.4

0.4%

57

PoC No patch

CVE-2026-15545

Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated remote users corrupt memory through the apcupsd web component. The flaw sits in the main() function of www/apcupsd/tomatodata.cgi, where crafted input reaches an out-of-bounds write (CWE-787) that can crash the CGI or potentially execute code on the router. Publicly available exploit code exists (via VulDB/Gitee), but there is no confirmed active exploitation; note that this project has been superseded by FreshTomato and is effectively end-of-life.

HIGH

7.4

0.4%

57

PoC No patch

CVE-2026-10870

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_dhcpc function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists per the VulDB advisory. The project has been discontinued and superseded by FreshTomato, meaning no upstream fix from the original maintainer is expected.

HIGH

7.3

0.1%

57

PoC No patch

CVE-2026-10871

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary shell commands by manipulating the ipv6_6rd_borderrelay argument processed by the start_6rd_tunnel function in /sbin/rc via the Web UI. Publicly available exploit code exists per VulDB disclosure, and the project is end-of-life - superseded by FreshTomato - meaning no upstream fix is expected.

HIGH

7.3

0.1%

57

PoC No patch

CVE-2026-10872

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_vpnserver function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - meaning no upstream patch is forthcoming. The CVSS 4.0 score of 7.3 reflects high impact on confidentiality, integrity, and availability, but high privileges are required to trigger the flaw.

HIGH

7.3

0.1%

57

PoC No patch

CVE-2026-10873

OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary operating system commands by manipulating input to the rstats_path function within the /bin/rstats binary exposed via the Web UI. Publicly available exploit code exists per the Gitee advisory disclosed through VulDB, and the affected project is end-of-life - superseded by FreshTomato - meaning no upstream vendor patch is forthcoming. CVSS 4.0 base score is 7.3 with high privileges required but high confidentiality, integrity, and availability impact on the router.

HIGH

7.3

0.1%

57

PoC No patch

CVE-2026-16096

Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.

HIGH

8.7

0.4%

44

No patch

CVE-2026-16095

Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.

HIGH

8.7

0.4%

44

No patch

CVE-2026-15548

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, low-privileged attacker to corrupt the stack of the embedded web server (/usr/sbin/httpd) via the DNS List Rendering function sub_407220, potentially achieving arbitrary code execution on the router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low-level authentication (PR:L) to the web administration interface. VulDB assigns an exploit maturity of Proof-of-Concept, meaning publicly available exploit code exists, though it is not listed in CISA KEV and no active exploitation is confirmed. Notably, the Tomato project by Shibby is discontinued and superseded by FreshTomato, so no first-party fix is expected.

HIGH

7.4

0.7%

38

No patch

CVE-2026-15546

OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the jffs2_exec argument in the start_jffs2 component's sub_2D568 function. A publicly available proof-of-concept exploit exists on Gitee, confirming exploitability beyond theoretical analysis. The project is officially abandoned and superseded by FreshTomato, meaning no vendor patch will ever be released - remediation requires migrating to supported firmware.

LOW

2.1

1.1%

30

PoC No patch

CVE-2026-15547

OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrary commands on the underlying router OS by manipulating the cifs1 or cifs2 arguments passed to the CIFS Mount Handler function sub_2D048. A publicly available proof-of-concept exploit exists on Gitee, lowering the barrier to exploitation. The risk is compounded by the fact that Shibby Tomato is an end-of-life project with no active maintenance, superseded by FreshTomato, meaning no patch is forthcoming from the original vendor.

LOW

2.1

1.1%

30

PoC No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (1)

Top Risky CVEs