This vulnerability (CVE-2026-10870) affects Shibby Tomato 1.28.0000 in the start_dhcpc function of the /sbin/rc file, part of the Web UI component. It allows remote OS command injection, enabling attackers with high privileges to execute arbitrary commands on the affected system. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known and exploitable, but no official patch or remediation level has been provided. The Shibby Tomato project is superseded by FreshTomato, which may imply no further updates for this version.

Successful exploitation allows remote attackers with high privileges to execute arbitrary operating system commands on the affected device, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. Given the network attack vector and no required user interaction, exploitation can be performed remotely and autonomously.

No official patch or remediation is currently available for this vulnerability. Since the Shibby Tomato project is superseded by FreshTomato, users are advised to migrate to FreshTomato or other supported firmware versions. Until a fix is available, restricting network access to the affected device and disabling the vulnerable Web UI component, if possible, may reduce exposure. Monitor vendor advisories for updates or official patches.