# CVE-2026-15547: Shibby Tomato OS command injection in CIFS Mount Handler

Source: https://junglewise.ai/threats/cve-2026-15547-shibby-tomato-os-command-injection-in-cifs-mount-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-15547 · Severity: medium · CVSS 6.3 · Published 2026-07-13

Shibby Tomato is a third-party firmware used for various network routers. A security flaw in the way it handles network storage (CIFS) connections allows an authenticated user to run unauthorized commands on the router. If an attacker can modify the router's configuration settings, they can gain full control over the device, potentially leading to data interception or network disruption.

Technologies: [Shibby Tomato](https://junglewise.ai/threats/technologies/tomato). Vendors: [Shibby](https://junglewise.ai/threats/vendors/shibby).

## Quick answers

**Is CVE-2026-15547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15547 being exploited in the wild.

**How severe is CVE-2026-15547?** Medium severity, with a CVSS score of 6.3, published 13 July 2026.

**Which products and versions are affected?** Shibby Tomato up to 1.28.0000.

**Is there a fix for CVE-2026-15547?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15547 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-15547?** Check whether you run Shibby Tomato at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the CIFS mount handler (function sub_2D048) within the sbin/rc binary of Shibby Tomato firmware. The component retrieves the 'cifs1' or 'cifs2' NVRAM keys and parses them using a '<' delimiter via vstrsep(). The 6th field of this parsed string, intended for post-mount execution, is passed directly to the system() function without any sanitization or escaping. An attacker with the ability to modify NVRAM (via the Web UI or SSH) can inject shell commands that execute with root privileges once a CIFS mount operation is successfully triggered. This project is superseded by FreshTomato, and users are encouraged to migrate.

## Affected products

- Shibby Tomato up to 1.28.0000

## Timeline

- 2026-06-10: disclosed: Initial discovery and report by Fengyi Wang
- 2026-07-13: advisory: CVE published and listed in NVD/VulDB

## References

- [https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5P](https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5P)
- [https://vuldb.com/cve/CVE-2026-15547](https://vuldb.com/cve/CVE-2026-15547)
- [https://vuldb.com/submit/855117](https://vuldb.com/submit/855117)
- [https://vuldb.com/vuln/377897](https://vuldb.com/vuln/377897)
- [https://vuldb.com/vuln/377897/cti](https://vuldb.com/vuln/377897/cti)

## Related threats

- [Shibby Tomato stack overflow and command injection in Scheduler Name Handler](https://junglewise.ai/threats/cve-2026-16097-shibby-tomato-stack-overflow-and-command-injection-in-scheduler)
- [Shibby Tomato stack overflow in httpd DNS List Rendering](https://junglewise.ai/threats/cve-2026-15548-shibby-tomato-stack-overflow-in-httpd-dns-list-rendering)
- [Shibby Tomato OS command injection in rstats_path](https://junglewise.ai/threats/cve-2026-10873-shibby-tomato-os-command-injection-in-rstats-path)
- [Shibby Tomato command injection in start_vpnserver](https://junglewise.ai/threats/cve-2026-10872-shibby-tomato-command-injection-in-start-vpnserver)
- [Shibby Tomato OS command injection in start_6rd_tunnel](https://junglewise.ai/threats/cve-2026-10871-shibby-tomato-os-command-injection-in-start-6rd-tunnel)