Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Shibby Tomato Web UI Allows Remote Code Execution

CVE-2026-10870 · published 5 months ago
Summary

A security flaw in Shibby Tomato's Web UI component allows an attacker to execute malicious commands remotely. This affects Shibby Tomato version 1.28.0000. We recommend updating to a newer version, such as FreshTomato, which is a more secure alternative.

Original advisory text
A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible t...
A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
2% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published4 Jun 2026
Updated4 Nov 2026
First seen4 Jun 2026
Sources
CVE-2026-10870 · NVD
Track software like this
Free during beta