CVE-2026-10068 Overview
CVE-2026-10068 is a server-side request forgery (SSRF) vulnerability in Shibby Tomato 1.28, an unmaintained router firmware project superseded by FreshTomato. The flaw resides in the send function within usr/sbin/miniupnpd, specifically in the SUBSCRIBE call handler component. Remote attackers can manipulate input to coerce the affected service into issuing arbitrary outbound requests. Because Shibby Tomato is no longer supported by its maintainer, no official patch is forthcoming. The vulnerability is classified under [CWE-918]: Server-Side Request Forgery.
Critical Impact
Unauthenticated remote attackers can abuse the miniupnpd SUBSCRIBE handler to issue forged requests from the router, potentially exposing internal network resources on devices running end-of-life Shibby Tomato 1.28.
Affected Products
- Shibby Tomato 1.28 (usr/sbin/miniupnpd)
- SUBSCRIBE Call Handler component
- Project status: superseded by FreshTomato and no longer maintained
Discovery Timeline
- 2026-05-29 - CVE-2026-10068 published to NVD
- 2026-05-29 - Last updated in NVD database
Technical Details for CVE-2026-10068
Vulnerability Analysis
The vulnerability exists in the send function inside usr/sbin/miniupnpd, the Universal Plug and Play (UPnP) Internet Gateway Device daemon shipped with Shibby Tomato 1.28. The SUBSCRIBE call handler processes UPnP eventing requests, which include a callback URL that the daemon contacts to deliver event notifications. The handler accepts attacker-controlled destination data without sufficient validation. As a result, an unauthenticated remote attacker can direct the daemon to issue requests toward arbitrary hosts and ports reachable from the router.
Root Cause
The root cause is missing validation of the callback URL supplied in UPnP SUBSCRIBE messages before it is passed to the network send routine. The handler does not restrict targets to safe address ranges, enforce protocol allowlists, or otherwise constrain destinations. This category of flaw is tracked as [CWE-918] Server-Side Request Forgery.
Attack Vector
The attack is launched over the network with low complexity and requires no privileges or user interaction. An attacker who can reach the UPnP service sends a crafted SUBSCRIBE request with a malicious callback URL. The router then transmits forged HTTP traffic from its own network position, which may include the LAN side of the device. This can be used to probe internal services, interact with management interfaces, or relay requests to otherwise unreachable systems.
No verified exploit code is publicly available. Technical discussion is referenced in the Gitee CVE Issue Discussion and the VulDB Vulnerability Details.
Detection Methods for CVE-2026-10068
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the router toward internal RFC1918 addresses or loopback ports.
- Inbound UPnP SUBSCRIBE requests containing Callback: headers that reference internal or unusual hosts.
- miniupnpd log entries showing event delivery attempts to destinations outside the local subscriber set.
Detection Strategies
- Inspect UPnP traffic on port 1900 and the miniupnpd HTTP control port for SUBSCRIBE requests with suspicious Callback URLs.
- Correlate router-originated egress flows with UPnP eventing activity to identify SSRF-driven probing.
- Alert on any UPnP service exposed to untrusted network segments, including the WAN interface.
Monitoring Recommendations
- Capture and review miniupnpd logs for repeated SUBSCRIBE requests from a single source.
- Monitor NetFlow or firewall logs for the router contacting internal management addresses it does not normally reach.
- Track DNS queries from the router for domains that do not match its normal update or NTP destinations.
How to Mitigate CVE-2026-10068
Immediate Actions Required
- Restrict access to the miniupnpd control port so that only trusted LAN segments can send SUBSCRIBE requests.
- Disable UPnP on Shibby Tomato 1.28 devices that do not require it for client applications.
- Plan migration away from Shibby Tomato to a maintained firmware such as FreshTomato, since the project is end-of-life.
Patch Information
No official patch is available. Shibby Tomato 1.28 is no longer maintained, and the project has been superseded by FreshTomato. Operators should migrate to a supported firmware that receives security updates rather than wait for a backported fix.
Workarounds
- Turn off UPnP entirely in the router administration interface when not strictly required.
- Use firewall rules to block external access to the UPnP HTTP control port and to restrict outbound requests from the router to known-good destinations.
- Segment the management network so that the router cannot reach sensitive internal services from its own interfaces.
# Example: disable UPnP and block external access to miniupnpd on Tomato-based firmware
nvram set upnp_enable=0
nvram commit
service miniupnpd stop
iptables -I INPUT -i $(nvram get wan_iface) -p tcp --dport 5000 -j DROP
iptables -I INPUT -i $(nvram get wan_iface) -p udp --dport 1900 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
