CVE-2026-10872: Shibby Tomato Web UI rc start_vpnserver os command injection

Synopsis

An OS command injection vulnerability exists in the Web UI component of Shibby Tomato firmware version 1.28.0000, specifically in the start_vpnserver function within /sbin/rc. The flaw is reachable over the network and requires a high-privilege account, but once exploited it allows an attacker to execute arbitrary operating system commands on the device. Successful exploitation gives the attacker full read, write, and denial-of-service capability over the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable start_vpnserver function is exposed over the network, so an attacker must be able to reach the device's Web UI interface across the network to deliver the malicious input.

• AuthenticationRequired

  Exploitation requires a high-privilege (admin-level) account on the Tomato Web UI; a low-privilege or unauthenticated session is not sufficient.

• Victim interactionNot required

  No action from a logged-in user or device owner is needed; the attacker can trigger the injection directly after authenticating.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access and valid admin credentials.

Blast Radius

• Reads arbitrary files and sensitive configuration data stored on the device, including VPN credentials and network settings.
• Writes or overwrites files on the device filesystem, enabling persistent backdoors or configuration tampering.
• Executes arbitrary OS commands with the privilege level of the rc process, giving the attacker full control over the firmware environment.
• Crashes or disrupts services running on the device, causing loss of network routing or VPN connectivity for dependent clients.