Executive brief
Shibby Tomato is an open-source firmware used for various network routers. A vulnerability in its VPN server management allows an administrator to execute arbitrary commands with the highest system privileges (root). This could lead to complete device takeover, allowing an attacker to intercept network traffic, modify router settings, or use the device as a foothold for further attacks on the local network.
Technical details
A vulnerability exists in the 'start_vpnserver' function within '/sbin/rc' of Shibby Tomato firmware. The flaw involves two distinct injection vectors: first, a command injection (CWE-78) via the 'vpn_server%d_proto' NVRAM variable where embedded newlines are written into a shell script at '/etc/openvpn/fw/server%d-fw.sh' and subsequently executed; second, a configuration injection (CWE-74) via 'vpn_server%d_custom' which allows an attacker to insert arbitrary OpenVPN directives like 'up' or 'script-security' into 'config.ovpn'. Both paths allow an authenticated web administrator to escalate privileges to root. The project is superseded by FreshTomato, and users are encouraged to migrate as no official patch for the Shibby distribution is expected.
Affected products
- Shibby Tomato 1.28.0000 MIPSR2-124 K26 USB Big-VPN 1.28.0000
Timeline
- 2026-05-17: disclosed: Initial researcher disclosure on Gitee
- 2026-06-04: advisory: CVE published and VulDB entry created
References
- https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/03-start_vpnserver.md
- https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/zh/03-start_vpnserver.md
- https://vuldb.com/cve/CVE-2026-10872
- https://vuldb.com/submit/831858
- https://vuldb.com/vuln/368362
- https://vuldb.com/vuln/368362/cti