Executive brief
Shibby Tomato is a popular alternative firmware for home and small-office routers. A vulnerability in its web management interface allows an administrator to execute arbitrary system commands with root privileges. By entering specially crafted text into the IPv6 6rd configuration settings, an attacker can take full control of the router, potentially leading to data theft, network monitoring, or persistent backdoors. This project is no longer maintained and has been replaced by FreshTomato.
Technical details
An OS command injection vulnerability (CWE-78) exists in the 'start_6rd_tunnel' function within '/sbin/rc' of Shibby Tomato 1.28.0000. The vulnerability is triggered when the system processes the 'ipv6_6rd_borderrelay' NVRAM variable (or the 4th field of 'wan_6rd'). The application uses 'sprintf' to format a 'ping' command string using these unsanitized inputs and subsequently executes it via 'popen()'. Because 'popen' invokes '/bin/sh -c', shell metacharacters such as semicolons or command substitution can be used to execute arbitrary code. While the code contains an 'inet_aton' check, it occurs after the 'popen' call, providing no mitigation. This vulnerability requires web administrative privileges to exploit. The Shibby Tomato project is superseded by FreshTomato.
Affected products
- Shibby Tomato by Shibby 1.28.0000
Timeline
- 2026-05-17: disclosed: Initial researcher disclosure on Gitee
- 2026-06-04: advisory: CVE published to NVD dataset
References
- https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/02-start_6rd_tunnel.md
- https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/02-start_6rd_tunnel.md
- https://vuldb.com/cve/CVE-2026-10871
- https://vuldb.com/submit/831857
- https://vuldb.com/vuln/368361
- https://vuldb.com/vuln/368361/cti