CVE-2026-15546
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A security flaw in Shibby Tomato up to 1.28.0000 affects the sub_2D568 function of the start_jffs2 component. Manipulating the jffs2_exec argument leads to OS command injection. Remote exploitation is possible and the exploit has been publicly released.
Risk Assessment
The organization is at risk of remote code execution on affected Tomato devices, potentially allowing attackers to execute arbitrary commands and escalate privileges.
Recommendation
Immediately upgrade to FreshTomato as Shibby Tomato is no longer supported. If upgrade is not possible, restrict access to the management interface.
Other vulnerabilities in Shibby Tomato
See all- CVE-2026-19036High
A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
- CVE-2026-19035High
A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.
- CVE-2026-19034High
A vulnerability was found in Shibby Tomato 1.28.0000 in the function new_qoslimit_stop of /tmp/qoslimittc_stop.sh. Manipulating the wan_iface argument leads to OS command injection. The attack can be launched remotely.
- CVE-2026-16097High
A stack-based buffer overflow vulnerability was found in Shibby Tomato 1.28 in the sub_42537C function of the Scheduler Name Handler component. Manipulation of the a1 argument allows remote exploitation. This project is superseded by FreshTomato.
- CVE-2026-16096High
In Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124, a stack-based buffer overflow vulnerability exists in the sub_40BB50 function of the /proc/webmon_recent_domains file. The attack can be performed remotely. This project is superseded by FreshTomato.
- CVE-2026-16095High
A flaw in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 in the setup_conntrack function of /sbin/rc allows out-of-bounds write via the ct_tcp_timeout argument. The attack can be performed remotely.
- CVE-2026-15548High
A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.
- CVE-2026-15547Medium
A vulnerability in Shibby Tomato up to version 1.28.0000 allows OS command injection via the CIFS Mount Handler component's sub_2D048 function. Manipulating the cifs1/cifs2 argument enables remote command execution. The exploit is publicly available, increasing attack risk.
- CVE-2026-15544High
In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-10873High
A vulnerability in Shibby Tomato 1.28.0000 in the rstats_path function allows remote OS command injection. Exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.