CVE-2026-19034

HIGH 7.2

Shibby Tomato qoslimittc_stop.sh new_qoslimit_stop os command injection

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in Shibby Tomato 1.28.0000. Affected by this vulnerability is the function new_qoslimit_stop of the file /tmp/qoslimittc_stop.sh. Executing a manipulation of the argument wan_iface can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

CWE	CWE-78 CWE-77
Vendor	shibby
Product	tomato
Published	Aug 6, 2026
Last Updated	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for shibby tomato

Be the first to know when new high vulnerabilities affecting shibby tomato are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Shibby / Tomato

1.28.0000

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/386453 vuldb.com: https://vuldb.com/vuln/386453/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19034 vuldb.com: https://vuldb.com/submit/863598 gitee.com: https://gitee.com/WH-YHUST/tomato-rc-qos-ppp-cve/blob/master/advisories/en/01-new_qoslimit_stop.md

Credits

🔍 WH-YHUST (VulDB User) VulDB CNA Team