CVE-2026-10872: Shibby Tomato Web UI rc start_vpnserver os command injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-04 · updated 2026-07-22
Weakness: CWE-77

Description

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

Affected products

Shibby Tomato: 1.28.0000

References

https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/03-start_vpnserver.md
https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/03-start_vpnserver.md
https://vuldb.com/cve/CVE-2026-10872
https://vuldb.com/submit/831858
https://vuldb.com/vuln/368362
https://vuldb.com/vuln/368362/cti

Get alerted when CVE-2026-10872 or the next vulnerability affects your stack