CVE-2026-10871: Shibby Tomato Web UI rc start_6rd_tunnel os command injection

Synopsis

An OS command injection vulnerability affects the web UI of Shibby Tomato firmware version 1.28.0000. An attacker with administrative credentials can reach the vulnerable function start_6rd_tunnel in /sbin/rc over the network and inject arbitrary shell commands through the ipv6_6rd_borderrelay argument. Successful exploitation gives the attacker full control over the device, including the ability to read, modify, or destroy data and disrupt service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's web UI over the network; the vulnerability is remotely exploitable without requiring local or physical access.

• AuthenticationRequired

  An administrative (high-privilege) account is needed to access the web UI endpoint that exposes the vulnerable function.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker sends the crafted request directly.

• Attack complexityDetail

  Exploit complexity is low: the injection requires no race conditions, special memory layout, or environmental preconditions, making it reliable and repeatable.

Blast Radius

• Reads all data accessible to the firmware process, including stored credentials, Wi-Fi passphrases, and configuration secrets.
• Modifies device configuration, firewall rules, or routing tables, enabling persistent backdoors or traffic interception.
• Crashes or reboots the affected device, cutting off network connectivity for all clients depending on it.
• Executes arbitrary OS commands with the privilege level of the rc process, giving the attacker effective full-device control.