CVE-2026-19034
HighCVSS 7.2Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
A vulnerability was found in Shibby Tomato 1.28.0000 in the function new_qoslimit_stop of /tmp/qoslimittc_stop.sh. Manipulating the wan_iface argument leads to OS command injection. The attack can be launched remotely.
Risk Assessment
A remote attacker can execute arbitrary system commands on the device, potentially leading to full system compromise. The exploit is publicly disclosed.
Recommendation
Update to FreshTomato as Shibby Tomato is superseded. If not possible, restrict access to the device and apply appropriate filtering.
Other vulnerabilities in Shibby Tomato
See all- CVE-2026-19036High
A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
- CVE-2026-19035High
A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.
- CVE-2026-16097High
A stack-based buffer overflow vulnerability was found in Shibby Tomato 1.28 in the sub_42537C function of the Scheduler Name Handler component. Manipulation of the a1 argument allows remote exploitation. This project is superseded by FreshTomato.
- CVE-2026-16096High
In Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124, a stack-based buffer overflow vulnerability exists in the sub_40BB50 function of the /proc/webmon_recent_domains file. The attack can be performed remotely. This project is superseded by FreshTomato.
- CVE-2026-16095High
A flaw in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 in the setup_conntrack function of /sbin/rc allows out-of-bounds write via the ct_tcp_timeout argument. The attack can be performed remotely.
- CVE-2026-15548High
A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.
- CVE-2026-15547Medium
A vulnerability in Shibby Tomato up to version 1.28.0000 allows OS command injection via the CIFS Mount Handler component's sub_2D048 function. Manipulating the cifs1/cifs2 argument enables remote command execution. The exploit is publicly available, increasing attack risk.
- CVE-2026-15546Medium
A security flaw in Shibby Tomato up to 1.28.0000 affects the sub_2D568 function of the start_jffs2 component. Manipulating the jffs2_exec argument leads to OS command injection. Remote exploitation is possible and the exploit has been publicly released.
- CVE-2026-15544High
In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-10873High
A vulnerability in Shibby Tomato 1.28.0000 in the rstats_path function allows remote OS command injection. Exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.