CVE-2026-10873: Shibby Tomato Web UI rstats rstats_path os command injection

Synopsis

An OS command injection vulnerability affects the rstats component of the Shibby Tomato 1.28.0000 router firmware web UI. The flaw is reachable over the network by an attacker who holds administrator credentials, and a proof-of-concept exploit has been publicly disclosed. Successful exploitation gives the attacker arbitrary OS command execution on the device, with full read, write, and availability impact on the local system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attack is launched over the network, so the device's web UI must be reachable by the attacker across a network path.

• AuthenticationRequired

  The attacker must hold a high-privilege (administrator) account on the Shibby Tomato web UI before the injection point can be reached.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the vulnerability directly through crafted requests to the web UI.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental pre-conditions beyond network access and credentials.

Blast Radius

• Reads all files and data accessible to the rstats process, including stored configuration, credentials, and any sensitive router state.
• Writes or overwrites arbitrary files on the device, enabling persistent backdoors or configuration tampering.
• Executes arbitrary OS commands, giving the attacker full control over the router's operating environment.
• Crashes or disrupts the affected service or the entire device, causing a denial of network routing for connected clients.