Vulnerability · Published Aug 6, 2026 · Assigned by VulDB
CVE-2026-19036Shibby Tomato wanoptions sub_40F88C os command injection
High 7.2
In plain English
A high-severity OS command injection in Tomato from Shibby. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)3.2%top 11.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-386455 | Shibby Tomato wanoptions sub_40F88C os command injection vdb-entry, technical-description
- VDB-386455 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-19036 | CVE Analysis and Report third-party-advisory
- Submit #863669 | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 Mini (tomato-K26-1.28.RT-MIPSR2-124-Mini.trx, build5x-124-EN, 2014-12-24). Verified on research sample OS Command Injection (CWE-78, post-authentication) third-party-advisory
- https://gitee.com/WH-YHUST/tomato-rc-qos-ppp-cve/blob/master/advisories/en/03-sub_40F88C-pppd.md exploit