CVE-2026-19035 in Tomato
Summary
by MITRE • 08/06/2026
A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability resides in Shibby Tomato version 1.28.0000 within the Quality of Service limiting functionality, specifically in the new_qoslimit_start function located in the /etc/qoslimit file. The flaw manifests when the new_qoslimit_enable argument is manipulated, creating an operating system command injection vector that allows attackers to execute arbitrary commands on the affected device with the privileges of the running service. This represents a critical security weakness that directly violates the principle of least privilege and demonstrates poor input validation practices.
The technical implementation of this vulnerability stems from inadequate sanitization of user-supplied parameters within the QoS limiting configuration interface. When an attacker supplies malicious input to the new_qoslimit_enable parameter, the system fails to properly validate or escape the input before incorporating it into system commands. This creates a direct path for command injection attacks that can be exploited through remote network access, making it particularly dangerous in networked environments where devices are accessible from external networks. The vulnerability aligns with CWE-78, which specifically addresses OS Command Injection flaws.
The operational impact of this vulnerability is severe as it allows remote attackers to gain unauthorized control over the affected router or network device. Attackers could potentially execute commands such as spawning reverse shells, modifying system configurations, accessing sensitive data, or even installing persistent backdoors. The exploit being publicly available significantly increases the risk profile, as it removes the requirement for advanced exploitation techniques and makes the attack surface accessible to threat actors with minimal technical expertise. This vulnerability directly maps to several ATT&CK techniques including T1059.001 for command and scripting interpreter and T1021.001 for remote services.
Given that this project is superseded by FreshTomato, users should immediately migrate to the newer firmware version which contains proper input validation and sanitization mechanisms. The recommended mitigation strategy involves applying the latest firmware update from the official FreshTomato repository or implementing network segmentation to limit access to the affected device. Additionally, administrators should disable unnecessary services, implement strong authentication measures, and monitor network traffic for suspicious activities that might indicate exploitation attempts. Network-based intrusion detection systems should be configured to alert on unusual command execution patterns and potential exploitation of known vulnerabilities in embedded devices.