High severity7.2NVD Advisory· Published Aug 6, 2026

CVE-2026-19036

Description

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Shibby/Shibby Tomatollm-fuzzy
Range: = 1.28.0000

Patches

Vulnerability mechanics

References

News mentions

No linked articles in our index yet.

Severity

HighCVSS v3.1

7.2/ 10

CVSS v47.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: High
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

VYPR risk score

Composite of severity, exploitation, and reach.

0.47medium

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVE ID

CVE-2026-19036

Credits

W(
WH-YHUST (VulDB User)
reporter
VC
VulDB CNA Team
coordinator