CVE-2026-19034 Overview
CVE-2026-19034 is an operating system command injection vulnerability in Shibby Tomato 1.28.0000, a discontinued router firmware distribution. The flaw resides in the new_qoslimit_stop function within /tmp/qoslimittc_stop.sh. Attackers can manipulate the wan_iface argument to inject arbitrary shell commands that execute in the context of the underlying router process. The issue is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command). The exploit has been publicly disclosed, increasing exposure risk for any organization still running affected devices. Shibby Tomato is superseded by FreshTomato, and no vendor patch is expected for the affected build.
Critical Impact
Remote attackers with valid credentials can inject OS commands through the wan_iface parameter, leading to full command execution on the router.
Affected Products
- Shibby Tomato firmware version 1.28.0000
- The new_qoslimit_stop function in /tmp/qoslimittc_stop.sh
- Legacy deployments not migrated to FreshTomato
Discovery Timeline
- 2026-08-06 - CVE-2026-19034 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-19034
Vulnerability Analysis
The vulnerability exists in the QoS (Quality of Service) limit teardown logic of Shibby Tomato 1.28.0000. When the router invokes new_qoslimit_stop inside /tmp/qoslimittc_stop.sh, it uses the wan_iface argument to build shell commands without proper neutralization of shell metacharacters. An authenticated attacker who can influence the wan_iface value can append arbitrary commands that the shell executes with the privileges of the router process. Because the router process typically runs with elevated privileges, successful exploitation compromises the confidentiality, integrity, and availability of the device. The attack is remotely reachable over the network, and public exploit details are available through the referenced advisory.
Root Cause
The root cause is unsafe concatenation of the wan_iface value into a shell command string within the QoS stop script. The firmware does not validate or escape shell metacharacters such as ;, |, &, or backticks before invoking the shell.
Attack Vector
An authenticated attacker sends a crafted request to the router management interface that sets wan_iface to a value containing shell metacharacters. When the QoS limit is stopped, the injected payload is executed by the shell interpreting /tmp/qoslimittc_stop.sh. Refer to the Gitee Security Advisory and VulDB CVE-2026-19034 for the disclosed technical proof-of-concept.
No verified code examples are available for this advisory. Reviewers should consult the linked advisory for the exact injection payload structure.
Detection Methods for CVE-2026-19034
Indicators of Compromise
- Unexpected child processes spawned by /tmp/qoslimittc_stop.sh or the QoS management daemon
- Router configuration changes to the wan_iface NVRAM variable containing shell metacharacters (;, |, &, $(, backticks)
- Outbound network connections from the router to unknown hosts shortly after QoS reconfiguration events
- New or modified files in /tmp on the router file system that were not created by the firmware
Detection Strategies
- Inspect NVRAM and configuration backups for non-alphanumeric characters in the wan_iface variable
- Monitor administrative HTTP requests that alter QoS settings, particularly those setting interface parameters to unusual values
- Correlate authentication events on the router management interface with subsequent QoS stop/start operations
Monitoring Recommendations
- Forward router syslog and shell audit logs to a central data lake for retention and query
- Alert on execution of shell built-ins or utilities (wget, curl, nc, busybox) from within QoS shutdown workflows
- Track administrative session origins and flag logins from untrusted networks against embedded devices
How to Mitigate CVE-2026-19034
Immediate Actions Required
- Restrict access to the router management interface to trusted management VLANs and known administrator IP addresses
- Rotate administrative credentials on all Shibby Tomato devices, since exploitation requires authenticated access
- Audit wan_iface configuration values and reset any that contain non-standard characters
- Migrate affected devices to FreshTomato, the actively maintained successor project
Patch Information
Shibby Tomato is no longer maintained. No official patch is available for version 1.28.0000. The upstream guidance is to migrate to FreshTomato, which supersedes the Shibby fork. Consult the Gitee Security Advisory and VulDB Vulnerability #386453 for disclosure details.
Workarounds
- Disable the QoS limit feature if it is not required for the deployment
- Enforce firewall rules that block the router administration ports from WAN and untrusted LAN segments
- Require multi-factor authentication or VPN access before reaching the router management console
- Replace unsupported hardware or firmware with a maintained alternative such as FreshTomato or OpenWrt
# Configuration example: restrict management access to a trusted subnet
iptables -I INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -j DROP
iptables -I INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
