CVE-2026-19034 in Tomato
Summary
by MITRE • 08/06/2026
A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability exists within Shibby Tomato firmware version 1.28.0000, specifically targeting the new_qoslimit_stop function located in the /tmp/qoslimittc_stop.sh script file. The flaw represents a critical command injection vulnerability that arises from improper input validation when processing the wan_iface argument parameter. The vulnerability stems from insufficient sanitization of user-supplied input before executing system commands, creating an exploitable path where malicious actors can inject arbitrary operating system commands through the network interface identifier parameter.
The technical implementation of this vulnerability allows remote attackers to manipulate the wan_iface argument passed to the new_qoslimit_stop function, which subsequently executes shell commands without proper validation or escaping. This creates a direct pathway for command injection attacks where an attacker can execute arbitrary code on the affected device with the privileges of the process executing the vulnerable script. The attack surface is particularly concerning as it enables remote exploitation without requiring authentication, making it accessible to any network-connected attacker who can reach the device's management interface or network services.
The operational impact of this vulnerability extends beyond simple command execution, as it potentially allows adversaries to gain full control over the affected router or gateway device. Attackers could leverage this vulnerability to establish persistent backdoors, redirect traffic through malicious proxies, modify firewall rules, or extract sensitive configuration data from the device. The fact that this exploit has been publicly disclosed increases the risk profile significantly, as automated scanning tools can readily identify and exploit vulnerable devices without requiring specialized knowledge or custom payloads.
Security practitioners should note that this vulnerability aligns with CWE-78, which specifically addresses OS Command Injection flaws in software systems. The attack vector maps directly to ATT&CK technique T1059.001 for command and script execution, while the remote accessibility of the exploit corresponds to ATT&CK tactic TA0002 (execution) and TA0008 (lateral movement). Given that Shibby Tomato is superseded by FreshTomato, organizations should prioritize immediate migration to the newer firmware version that addresses this vulnerability. Mitigation strategies include implementing network segmentation to limit access to affected devices, applying firmware updates when available, and monitoring network traffic for suspicious command execution patterns. The vulnerability represents a critical risk for home and small office networks where these devices serve as primary gateways, potentially compromising entire network infrastructures through unauthorized access to the underlying operating system.