CVE-2026-15547

Shibby Tomato CIFS Mount sub_2D048 os command injection

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 5.3 Medium EPSS 1.8% KEV · Not listed
Description
A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulation of the argument cifs1/cifs2 can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This project is superseded by FreshTomato.

Analysis

AI-generated

Technical impact

The vulnerability resides in Shibby Tomato, where user‑controlled inputs for the cifs1/cifs2 arguments are insufficiently sanitized, allowing an attacker to inject and execute operating‑system commands. This flaw is aligned with CWE-77 and CWE-78. If exploited, an attacker could execute arbitrary OS commands on the device, potentially affecting the device’s functionality. (Based on the description, it is inferred that the command injection could lead to such impact.)

Affected Systems

Shibby Tomato versions up to 1.28.0000 are affected. The issue is tied to the sub_2D048 function in the CIFS Mount component. No other vendor or product variants are listed, and the product is superseded by FreshTomato.

Risk and Exploitability

The CVSS indicates moderate severity. The EPSS score of 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attacker needs remote access to manipulate the cifs1/cifs2 arguments, which can be done over the network. (Inferred: the requirement for remote access is based on the description stating 'The attack can be executed remotely.')

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware upgrade from Shibby or use a version newer than 1.28.0000 that patches the CIFS Mount Handler.
  • If upgrading is not possible, restrict remote traffic to the CIFS Mount service or place the device behind a firewall that limits access only to trusted hosts.
  • Sanitize all CIFS mount parameters and enforce strict input validation to eliminate the possibility of command injection if the feature is not required in the environment.

Generated by OpenCVE AI on July 31, 2026 at 12:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in Shibby Tomato up to 1.28.0000. This affects the function sub_2D048 of the component CIFS Mount Handler. Executing a manipulation of the argument cifs1/cifs2 can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This project is superseded by FreshTomato.
Title Shibby Tomato CIFS Mount sub_2D048 os command injection
First Time appeared Shibby
Shibby tomato
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*
Vendors & Products Shibby
Shibby tomato
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 13, 2026, 2:27 PM
Reserved
Jul 12, 2026, 9:01 PM

View source JSON

Updated
Jul 13, 2026, 2:27 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 9:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:15 PM

JSON