CVE-2026-15546: OS Command Injection in Shibby Tomato
A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
AI Analysis
Technical Summary
This vulnerability in Shibby Tomato firmware affects the start_jffs2 component's function sub_2D568. By manipulating the jffs2_exec argument, an attacker can perform OS command injection remotely. The vulnerability affects all versions up to and including 1.28.0000. There is no official remediation or patch available as per the current data, and the project itself has been superseded by FreshTomato. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices running Shibby Tomato firmware up to 1.28.0000. This can lead to unauthorized control over the device, potentially compromising confidentiality, integrity, and availability of the system. The CVSS score of 5.3 reflects a medium severity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory or project updates for current remediation guidance. Since the project is superseded by FreshTomato, migrating to FreshTomato firmware may be a practical mitigation. No official fix or temporary workaround is documented at this time.
CVE-2026-15546: OS Command Injection in Shibby Tomato
Description
A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/shibby/tomatocpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Shibby Tomato firmware affects the start_jffs2 component's function sub_2D568. By manipulating the jffs2_exec argument, an attacker can perform OS command injection remotely. The vulnerability affects all versions up to and including 1.28.0000. There is no official remediation or patch available as per the current data, and the project itself has been superseded by FreshTomato. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on affected devices running Shibby Tomato firmware up to 1.28.0000. This can lead to unauthorized control over the device, potentially compromising confidentiality, integrity, and availability of the system. The CVSS score of 5.3 reflects a medium severity impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory or project updates for current remediation guidance. Since the project is superseded by FreshTomato, migrating to FreshTomato firmware may be a practical mitigation. No official fix or temporary workaround is documented at this time.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-12T21:01:03.730Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a54a64468715ace43837a10
Added to database: 07/13/2026, 08:48:04 UTC
Last enriched: 07/14/2026, 07:59:13 UTC
Last updated: 08/27/2026, 22:52:09 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.