CVE-2026-10870

HighCVSS 7.2

Published: 04/06/2026(UTC)Updated: 08/06/2026(UTC)Translated: 09/06/2026(UTC)NVD NIST

Summary

A flaw has been found in Shibby Tomato 1.28.0000 affecting the function start_dhcpc of the file /sbin/rc of the Web UI component. This manipulation leads to os command injection, allowing for remote attack initiation.

Risk Assessment

This vulnerability poses a serious risk to organizations as an attacker can remotely execute arbitrary commands on the system.

Recommendation

It is recommended to upgrade to a newer version of the software, such as FreshTomato, to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.