The vulnerability CVE-2026-19035 exists in Shibby Tomato 1.28.0000 within the new_qoslimit_start function of the /etc/qoslimit file. An attacker can manipulate the new_qoslimit_enable argument to perform OS command injection remotely. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. The project Shibby Tomato is superseded by FreshTomato. No official patch or remediation level is provided in the available data.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the system. The vulnerability impacts confidentiality, integrity, and availability of the affected device. No known exploits are reported in the wild, but exploit code is publicly available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project is superseded by FreshTomato, consider migrating to FreshTomato or applying any available updates from the vendor. Until an official fix is available, restrict network access to the affected device and monitor for suspicious activity related to the new_qoslimit_enable parameter.