CVE-2026-10068
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Shibby Tomato 1.28, the SUBSCRIBE Call Handler component's send function in usr/sbin/miniupnpd allows a Server-Side Request Forgery (SSRF) attack. The vulnerability can be exploited remotely. The project is superseded by FreshTomato and is no longer supported.
Risk Assessment
An attacker can remotely force the router to make requests to internal or external resources, potentially leading to privilege escalation, data leakage, or further network compromise.
Recommendation
Immediately replace Shibby Tomato 1.28 with a supported version of FreshTomato or other up-to-date firmware. No patches are available for this version.
Other vulnerabilities in miniupnpd
See all- CVE-2026-5720Critical
An integer underflow vulnerability in miniupnpd's SOAPAction header parsing allows remote attackers to cause denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Improper length validation leads to an out-of-bounds memory read.
- CVE-2026-10069High
A vulnerability in Shibby Tomato 1.28 was found in an unknown function of the file usr/sbin/miniupnpd, leading to resource exhaustion. The attack can be launched remotely. This product is no longer supported by the maintainer.
Original NVD description (English source)
A flaw has been found in Shibby Tomato 1.28. The affected element is the function send of the file usr/sbin/miniupnpd of the component SUBSCRIBE Call Handler. This manipulation causes server-side request forgery. The attack may be initiated remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.