OS Command Injection Vulnerability in Shibby Tomato Web UI
CVE-2026-10871

8.6HIGH

Key Information:

Vendor

Shibby

Status
Tomato
Vendor
CVE Published:
4 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-10871?

A vulnerability has been identified in the Shibby Tomato firmware, specifically within version 1.28.0000. It affects the Web UI through the function start_6rd_tunnel located in the /sbin/rc file. By manipulating the ipv6_6rd_borderrelay parameter, an attacker can exploit this vulnerability to execute arbitrary OS commands remotely. This raises concerns regarding unauthorized access and control over affected devices. The exploit is now publicly known, highlighting the urgent need for users to secure their installations and consider transitioning to alternatives like FreshTomato.

Affected Version(s)

Tomato 1.28.0000

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-10871 - Proof of Concept

References

https://vuldb.com/vuln/368361
vdb-entrytechnical-description
https://vuldb.com/vuln/368361/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10871
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

WH-YHUST (VulDB User)
VulDB CNA Team
.