CVE-2026-10870CWE-77CWE-78

Shibby Tomato Web UI rc start_dhcpc os command injection

High · published June 4, 2026

CVSS v4.0

8.6

EPSS

Percentile

82.4

In the wild

Unconfirmed

What it is

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

The record

Technical detail

CVSS v4.0: 8.6 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS: 0.02199 · 82.4th percentile
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-06-04T20:30Z

EPSS history

Timeline

04 JUN 20:30Z
Shibby Tomato Web UI rc start_dhcpc os command injection
cvelistv5