CVE-2026-10870

Shibby Tomato Web UI rc start_dhcpc os command injection

8.6 High

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.20%Up 2.1 points since Jun 5, 2026

What each source reports

CVE List Score used 8.6

Shibby Tomato Web UI rc start_dhcpc os command injection

Record: CVE-2026-10870
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS 3.0: 7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS 2.0: 8.3 AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Weakness: CWE-78, CWE-77
Updated: 2026-11-02

EUVDEUVD-2026-34323 8.6

Record: EUVD-2026-34323
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pmrf-jcmc-23c7 7.3

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the...

Record: GHSA-pmrf-jcmc-23c7
CVSS 4.0: 7.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

NVD 7.3

Record: CVE-2026-10870
CVSS 4.0: 7.3 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 8.3 HighAV:N/AC:L/Au:M/C:C/I:C/A:C
Weakness: CWE-77, CWE-78
Updated: 2026-11-02

Affected products

shibby tomato

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-10870 is a high vulnerability (CVSS 8.6) in Shibby Tomato, published June 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. No source names a fixed version.