Is CVE-2026-15546 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15546 being exploited in the wild.

How severe is CVE-2026-15546?

Medium severity, with a CVSS score of 6.3, published 13 July 2026.

Is there a fix for CVE-2026-15546?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15546 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-15546?

Check whether you run Shibby Tomato Shibby. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15546: Shibby Tomato OS command injection in start_jffs2

CVE-2026-15546 · Severity: medium · CVSS 6.3 · Published 2026-07-13

A security flaw exists in the Shibby Tomato router firmware, which is used to manage home and small office network hardware. An attacker with administrative access to the router's web interface or command line can inject malicious commands that run with the highest system privileges (root). This could allow an attacker to establish a permanent backdoor on the device that survives reboots, potentially leading to full control over network traffic and connected devices.

Technologies: Shibby Tomato Shibby. Vendors: Shibby.

Quick answers

Is CVE-2026-15546 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15546 being exploited in the wild.
How severe is CVE-2026-15546?: Medium severity, with a CVSS score of 6.3, published 13 July 2026.
Which products and versions are affected?: Shibby Tomato up to 1.28.0000.
Is there a fix for CVE-2026-15546?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15546 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-15546?: Check whether you run Shibby Tomato Shibby. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the start_jffs2 function (sub_2D568) within the sbin/rc binary of Shibby Tomato firmware. The vulnerability is caused by the direct passing of the 'jffs2_exec' NVRAM variable to the system() C library function without any sanitization or escaping. An attacker with the ability to modify NVRAM (typically requiring authenticated access to the Web UI or SSH) can inject shell metacharacters into this variable. The injected commands are executed with root privileges during the JFFS2 partition startup sequence, which occurs during boot or when the service is manually started. While Shibby Tomato is no longer maintained and has been superseded by FreshTomato, this specific flaw provides a mechanism for persistent code execution.

Affected products

Shibby Tomato up to 1.28.0000

Timeline

2026-05-02: other: Vulnerability discovered via static analysis
2026-06-10: disclosed: Issue reported on Gitee repository
2026-07-13: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.