Is CVE-2026-15547 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15547 being exploited in the wild.

How severe is CVE-2026-15547?

Medium severity, with a CVSS score of 6.3, published 13 July 2026.

Is there a fix for CVE-2026-15547?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15547 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-15547?

Check whether you run Shibby Tomato at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15547: Shibby Tomato OS command injection in CIFS Mount Handler

CVE-2026-15547 · Severity: medium · CVSS 6.3 · Published 2026-07-13

Shibby Tomato is a third-party firmware used for various network routers. A security flaw in the way it handles network storage (CIFS) connections allows an authenticated user to run unauthorized commands on the router. If an attacker can modify the router's configuration settings, they can gain full control over the device, potentially leading to data interception or network disruption.

Technologies: Shibby Tomato. Vendors: Shibby.

Quick answers

Is CVE-2026-15547 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15547 being exploited in the wild.
How severe is CVE-2026-15547?: Medium severity, with a CVSS score of 6.3, published 13 July 2026.
Which products and versions are affected?: Shibby Tomato up to 1.28.0000.
Is there a fix for CVE-2026-15547?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15547 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-15547?: Check whether you run Shibby Tomato at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the CIFS mount handler (function sub_2D048) within the sbin/rc binary of Shibby Tomato firmware. The component retrieves the 'cifs1' or 'cifs2' NVRAM keys and parses them using a '<' delimiter via vstrsep(). The 6th field of this parsed string, intended for post-mount execution, is passed directly to the system() function without any sanitization or escaping. An attacker with the ability to modify NVRAM (via the Web UI or SSH) can inject shell commands that execute with root privileges once a CIFS mount operation is successfully triggered. This project is superseded by FreshTomato, and users are encouraged to migrate.

Affected products

Shibby Tomato up to 1.28.0000

Timeline

2026-06-10: disclosed: Initial discovery and report by Fengyi Wang
2026-07-13: advisory: CVE published and listed in NVD/VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.