Executive brief
Shibby Tomato is a third-party firmware used for various network routers. A security flaw in the way it handles network storage (CIFS) connections allows an authenticated user to run unauthorized commands on the router. If an attacker can modify the router's configuration settings, they can gain full control over the device, potentially leading to data interception or network disruption.
Technical details
An OS command injection vulnerability exists in the CIFS mount handler (function sub_2D048) within the sbin/rc binary of Shibby Tomato firmware. The component retrieves the 'cifs1' or 'cifs2' NVRAM keys and parses them using a '<' delimiter via vstrsep(). The 6th field of this parsed string, intended for post-mount execution, is passed directly to the system() function without any sanitization or escaping. An attacker with the ability to modify NVRAM (via the Web UI or SSH) can inject shell commands that execute with root privileges once a CIFS mount operation is successfully triggered. This project is superseded by FreshTomato, and users are encouraged to migrate.
Affected products
- Shibby Tomato up to 1.28.0000
Timeline
- 2026-06-10: disclosed: Initial discovery and report by Fengyi Wang
- 2026-07-13: advisory: CVE published and listed in NVD/VulDB