Executive Summary

This vulnerability is a flaw found in Shibby Tomato version 1.28.0000, specifically in the start_dhcpc function of the /sbin/rc file within the Web UI component.

The flaw allows for OS command injection, meaning an attacker can execute arbitrary operating system commands on the affected device.

The attack can be initiated remotely, and an exploit for this vulnerability has already been published.

The Shibby Tomato project has been superseded by FreshTomato.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows remote attackers to execute arbitrary OS commands on the affected device.

Such command injection can lead to full compromise of the device, including unauthorized access, data theft, disruption of services, or using the device as a foothold for further attacks.

Given the high CVSS scores (7.2 to 8.3), the vulnerability is considered high severity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the NVRAM key `dhcpc_custom` contains suspicious or malicious shell commands that could lead to command injection.

One practical detection method is to verify if the DHCP client executes injected commands by setting a test payload and observing its effect.

For example, a proof-of-concept command sets `dhcpc_custom` to a value that creates a file when executed:

• nvram set dhcpc_custom=';touch /tmp/pwned_dhcpc;#'
• nvram commit
• Restart the DHCP client or reboot the device to trigger the command execution.

If the file `/tmp/pwned_dhcpc` is created, it confirms the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the web admin interface to prevent unauthorized modification of the `dhcpc_custom` NVRAM key.

Additionally, avoid setting or allowing unsafe values in `dhcpc_custom` that could be interpreted as shell commands.

From a development or firmware perspective, remediation involves:

• Replacing unsafe string functions like `strcpy` and `strcat` with safer alternatives such as `strlcpy` and `strlcat`.
• Using `execve` with argument vectors for executing `udhcpc` to avoid shell interpretation of user input.
• Implementing whitelisting or strict validation of the `dhcpc_custom` values before execution.

Upgrading to a firmware version that supersedes Shibby Tomato 1.28.0000, such as FreshTomato, is recommended as a long-term fix.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-10870 allows an authenticated web administrator to execute arbitrary root commands remotely via command injection and stack buffer overflow vulnerabilities. This can lead to full system compromise, including unauthorized access to sensitive data, persistent backdoors, credential theft, and DNS hijacking.

Such impacts can severely affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability. A successful exploit could result in unauthorized disclosure or alteration of personal or sensitive health information, violating these regulations.

Therefore, this vulnerability poses a significant risk to meeting regulatory requirements related to data security and privacy.

Useful 0 Not Useful 0