PT-2026-46393 · Shibby · Tomato

Wh-Yhust · Publicado 2026-06-04 · Atualizado 2026-06-04 · CVE-2026-10871

NVD

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start 6rd tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6 6rd borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2026-10871

Produtos afetados

Tomato

Referências · 7

• 🔥 https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/02-start_6rd_tunnel.md · Exploit
• https://vuldb.com/submit/831857 · Nota
• https://vuldb.com/vuln/368361/cti · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-10871 · Nota de Segurança
• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/02-start_6rd_tunnel.md · Nota
• https://vuldb.com/vuln/368361 · Nota
• https://vuldb.com/cve/CVE-2026-10871 · Nota