CVE-2026-19034 is a command injection vulnerability in Shibby Tomato version 1.28.0000 affecting the new_qoslimit_stop function in the /tmp/qoslimittc_stop.sh script. An attacker with high privileges can remotely manipulate the wan_iface argument to execute arbitrary OS commands. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed, but no known exploits in the wild have been reported. The Shibby Tomato project is now superseded by FreshTomato.

Successful exploitation allows a remote attacker with high privileges to execute arbitrary OS commands on the affected device, leading to full compromise of confidentiality, integrity, and availability of the system. This can result in complete system takeover or disruption of network services.

No official patch or fix is currently available for this vulnerability. Since the Shibby Tomato project is superseded by FreshTomato, users are advised to migrate to FreshTomato or other maintained firmware versions. Until a fix is available, restrict access to the affected device to trusted users only and avoid exposing management interfaces to untrusted networks.