CVE-2026-10872

HIGH8.6

Shibby Tomato Web UI rc start_vpnserver os command injection

Published Jun 4, 2026

Modified 2 weeks ago

Details

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

References

WEB

https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/03-start_vpnserver.md

DETECTION

https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/03-start_vpnserver.md

ADVISORY

https://vuldb.com/cve/CVE-2026-10872

ADVISORY

https://vuldb.com/submit/831858

WEB

https://vuldb.com/vuln/368362

WEB