CVE-2026-15547
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A vulnerability in Shibby Tomato up to version 1.28.0000 allows OS command injection via the CIFS Mount Handler component's sub_2D048 function. Manipulating the cifs1/cifs2 argument enables remote command execution. The exploit is publicly available, increasing attack risk.
Risk Assessment
The organization risks remote takeover of devices running Shibby Tomato, potentially leading to data theft, malware installation, or use in DDoS attacks.
Recommendation
Immediately upgrade to FreshTomato, the successor to Shibby Tomato, which includes security fixes. If upgrade is not possible, restrict management interface access to trusted networks only.
Other vulnerabilities in Shibby Tomato
See all- CVE-2026-19036High
A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
- CVE-2026-19035High
A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.
- CVE-2026-19034High
A vulnerability was found in Shibby Tomato 1.28.0000 in the function new_qoslimit_stop of /tmp/qoslimittc_stop.sh. Manipulating the wan_iface argument leads to OS command injection. The attack can be launched remotely.
- CVE-2026-16097High
A stack-based buffer overflow vulnerability was found in Shibby Tomato 1.28 in the sub_42537C function of the Scheduler Name Handler component. Manipulation of the a1 argument allows remote exploitation. This project is superseded by FreshTomato.
- CVE-2026-16096High
In Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124, a stack-based buffer overflow vulnerability exists in the sub_40BB50 function of the /proc/webmon_recent_domains file. The attack can be performed remotely. This project is superseded by FreshTomato.
- CVE-2026-16095High
A flaw in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 in the setup_conntrack function of /sbin/rc allows out-of-bounds write via the ct_tcp_timeout argument. The attack can be performed remotely.
- CVE-2026-15548High
A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.
- CVE-2026-15546Medium
A security flaw in Shibby Tomato up to 1.28.0000 affects the sub_2D568 function of the start_jffs2 component. Manipulating the jffs2_exec argument leads to OS command injection. Remote exploitation is possible and the exploit has been publicly released.
- CVE-2026-15544High
In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-10873High
A vulnerability in Shibby Tomato 1.28.0000 in the rstats_path function allows remote OS command injection. Exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulation of the argument cifs1/cifs2 can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This project is superseded by FreshTomato.