Is CVE-2026-10872 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10872 being exploited in the wild.

How severe is CVE-2026-10872?

High severity, with a CVSS score of 7.2, published 4 June 2026.

Is there a fix for CVE-2026-10872?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10872 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-10872?

Check whether you run Shibby Tomato at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10872: Shibby Tomato command injection in start_vpnserver

CVE-2026-10872 · Severity: high · CVSS 7.2 · Published 2026-06-04

Shibby Tomato is an open-source firmware used for various network routers. A vulnerability in its VPN server management allows an administrator to execute arbitrary commands with the highest system privileges (root). This could lead to complete device takeover, allowing an attacker to intercept network traffic, modify router settings, or use the device as a foothold for further attacks on the local network.

Technologies: Shibby Tomato. Vendors: Shibby.

Quick answers

Is CVE-2026-10872 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10872 being exploited in the wild.
How severe is CVE-2026-10872?: High severity, with a CVSS score of 7.2, published 4 June 2026.
Which products and versions are affected?: Shibby Tomato 1.28.0000.
Is there a fix for CVE-2026-10872?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10872 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-10872?: Check whether you run Shibby Tomato at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the 'start_vpnserver' function within '/sbin/rc' of Shibby Tomato firmware. The flaw involves two distinct injection vectors: first, a command injection (CWE-78) via the 'vpn_server%d_proto' NVRAM variable where embedded newlines are written into a shell script at '/etc/openvpn/fw/server%d-fw.sh' and subsequently executed; second, a configuration injection (CWE-74) via 'vpn_server%d_custom' which allows an attacker to insert arbitrary OpenVPN directives like 'up' or 'script-security' into 'config.ovpn'. Both paths allow an authenticated web administrator to escalate privileges to root. The project is superseded by FreshTomato, and users are encouraged to migrate as no official patch for the Shibby distribution is expected.

Affected products

Shibby Tomato 1.28.0000 MIPSR2-124 K26 USB Big-VPN 1.28.0000

Timeline

2026-05-17: disclosed: Initial researcher disclosure on Gitee
2026-06-04: advisory: CVE published and VulDB entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.