Vulnerability · Published Jun 4, 2026 · Assigned by VulDB
CVE-2026-10872Shibby Tomato Web UI rc start_vpnserver os command injection
High 7.2
In plain English
A high-severity OS command injection in Tomato from Shibby. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.6%top 14.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-368362 | Shibby Tomato Web UI rc start_vpnserver os command injection vdb-entry, technical-description
- VDB-368362 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-10872 | CVE Analysis and Report third-party-advisory
- Submit #831858 | Tomato Tomato Firmware Shibby Tomato MIPS32; image d2e251333c48...; /sbin/rc MD5 a48002cdf3cda9452a5b9712edd179d2 OS Command Injection third-party-advisory
- https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/03-start_vpnserver.md related
- https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/03-start_vpnserver.md exploit