CVE-2026-15546

Shibby Tomato start_jffs2 sub_2D568 os command injection

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Description
A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

Analysis

AI-generated

Technical impact

The flaw resides in the start_jffs2 component of Shibby Tomato firmware, specifically in the sub_2D568 routine. Manipulating the jffs2_exec argument triggers an OS command injection that allows an attacker to execute arbitrary commands on the device, compromising its affected Tomato firmware versions up to 1.28.0000. The vulnerability is tied to the start_jffs2 handler used during system configuration and upgrade processes, and the project is superseded by FreshTomato.

Affected Systems

The vendor Shibby, product Tomato, versions up to 1.28.0000 are affected by this command injection flaw.

Risk and Exploitability

The CVSS base score of 5.3 indicates medium severity, and the EPSS score of 1% reflects a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that remote exploitation is possible via a network interface that accepts the jffs2_exec parameter; once the injection succeeds, an attacker can run arbitrary commands. Publicly available exploit code raises the practical risk for exposed devices.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Shibby Tomato firmware to a version beyond 1.28.0000 to remove the command injection vulnerability.
  • If an upgrade is not possible, block or disable remote access to the jffs2_exec interface, or disable the start_jffs2 functionality altogether.
  • Apply network segmentation or firewall rules to restrict external access to the device’s management interfaces, and monitor logs for anomalous command execution attempts.

Generated by OpenCVE AI on July 31, 2026 at 12:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
Title Shibby Tomato start_jffs2 sub_2D568 os command injection
First Time appeared Shibby
Shibby tomato
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*
Vendors & Products Shibby
Shibby tomato
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 13, 2026, 6:37 PM
Reserved
Jul 12, 2026, 9:01 PM

View source JSON

Updated
Jul 13, 2026, 6:35 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 9:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:15 PM

JSON