# CVE-2026-10871: Shibby Tomato OS command injection in start_6rd_tunnel

Source: https://junglewise.ai/threats/cve-2026-10871-shibby-tomato-os-command-injection-in-start-6rd-tunnel  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-10871 · Severity: high · CVSS 7.2 · Published 2026-06-04

Shibby Tomato is a popular alternative firmware for home and small-office routers. A vulnerability in its web management interface allows an administrator to execute arbitrary system commands with root privileges. By entering specially crafted text into the IPv6 6rd configuration settings, an attacker can take full control of the router, potentially leading to data theft, network monitoring, or persistent backdoors. This project is no longer maintained and has been replaced by FreshTomato.

Technologies: [Shibby Tomato](https://junglewise.ai/threats/technologies/tomato). Vendors: [Shibby](https://junglewise.ai/threats/vendors/shibby).

## Quick answers

**Is CVE-2026-10871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10871 being exploited in the wild.

**How severe is CVE-2026-10871?** High severity, with a CVSS score of 7.2, published 4 June 2026.

**Which products and versions are affected?** Shibby Tomato 1.28.0000.

**Is there a fix for CVE-2026-10871?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10871 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-10871?** Check whether you run Shibby Tomato at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the 'start_6rd_tunnel' function within '/sbin/rc' of Shibby Tomato 1.28.0000. The vulnerability is triggered when the system processes the 'ipv6_6rd_borderrelay' NVRAM variable (or the 4th field of 'wan_6rd'). The application uses 'sprintf' to format a 'ping' command string using these unsanitized inputs and subsequently executes it via 'popen()'. Because 'popen' invokes '/bin/sh -c', shell metacharacters such as semicolons or command substitution can be used to execute arbitrary code. While the code contains an 'inet_aton' check, it occurs after the 'popen' call, providing no mitigation. This vulnerability requires web administrative privileges to exploit. The Shibby Tomato project is superseded by FreshTomato.

## Affected products

- Shibby Tomato by Shibby 1.28.0000

## Timeline

- 2026-05-17: disclosed: Initial researcher disclosure on Gitee
- 2026-06-04: advisory: CVE published to NVD dataset

## References

- [https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/02-start_6rd_tunnel.md](https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/02-start_6rd_tunnel.md)
- [https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/02-start_6rd_tunnel.md](https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/02-start_6rd_tunnel.md)
- [https://vuldb.com/cve/CVE-2026-10871](https://vuldb.com/cve/CVE-2026-10871)
- [https://vuldb.com/submit/831857](https://vuldb.com/submit/831857)
- [https://vuldb.com/vuln/368361](https://vuldb.com/vuln/368361)
- [https://vuldb.com/vuln/368361/cti](https://vuldb.com/vuln/368361/cti)

## Related threats

- [Shibby Tomato stack overflow and command injection in Scheduler Name Handler](https://junglewise.ai/threats/cve-2026-16097-shibby-tomato-stack-overflow-and-command-injection-in-scheduler)
- [Shibby Tomato stack overflow in httpd DNS List Rendering](https://junglewise.ai/threats/cve-2026-15548-shibby-tomato-stack-overflow-in-httpd-dns-list-rendering)
- [Shibby Tomato OS command injection in CIFS Mount Handler](https://junglewise.ai/threats/cve-2026-15547-shibby-tomato-os-command-injection-in-cifs-mount-handler)
- [Shibby Tomato OS command injection in rstats_path](https://junglewise.ai/threats/cve-2026-10873-shibby-tomato-os-command-injection-in-rstats-path)
- [Shibby Tomato command injection in start_vpnserver](https://junglewise.ai/threats/cve-2026-10872-shibby-tomato-command-injection-in-start-vpnserver)