PT-2026-46398 · Shibby · Tomato

Wh-Yhust · Published 2026-06-04 · Updated 2026-06-04 · CVE-2026-10872

Mitre

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-10872

Affected Products

Tomato

References · 7

• 🔥 https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/03-start_vpnserver.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10872 · Security Note
• https://vuldb.com/vuln/368362 · Note
• https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/03-start_vpnserver.md · Note
• https://vuldb.com/cve/CVE-2026-10872 · Note
• https://vuldb.com/vuln/368362/cti · Note
• https://vuldb.com/submit/831858 · Note