Description

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-06T13:17:27.457Z",
  "pubdate": "2026-08-06T13:17:27.457Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in Shibby Tomato version 1.28.0000. The security flaw resides within the function sub_40F88C operating on the file /tmp/ppp/wanoptions, specifically triggered through the manipulation of the ppp_custom parameter. This vulnerability allows remote attackers to execute arbitrary operating system commands with the privileges of the underlying application, posing a severe risk to the confidentiality, integrity, and availability of the affected device. Public exploits for this flaw have been released, significantly increasing the likelihood of active exploitation in the wild. Given that Shibby Tomato 1.28.0000 is an older firmware version that has been officially superseded by FreshTomato, standard vendor patches for this specific release are unavailable. The combination of remote attack vectors, public exploit availability, and elevated execution privileges necessitates immediate remediation actions, primarily involving firmware migration to a supported and actively maintained project.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw stemming from insufficient input validation and sanitization of user-supplied data handled by the firmware. Specifically, the vulnerable component is the function sub_40F88C located within the execution context of the /tmp/ppp/wanoptions handler script or binary. When processing configuration parameters related to Point-to-Point Protocol (PPP) settings, the application accepts input via the ppp_custom argument without adequately neutralizing shell metacharacters, command separators, or control operators.\nThe attack flow initiates when a remote threat actor crafts a malicious input string containing arbitrary system commands appended or injected via the ppp_custom parameter. Upon submission, the vulnerable function sub_40F88C processes this unsanitized string and passes it directly to the underlying operating system shell or a system execution function (such as system() or popen()) without employing proper argument separation or escaping mechanisms. As a result, the injected command payload is executed by the system shell alongside or in place of the intended legitimate operations.\nBecause the affected firmware component processes network-facing configuration data, the attack surface is exposed to remote exploitation depending on the WAN or administrative interface exposure configuration of the device. Successful exploitation requires no prior authentication or specialized privileges if the vulnerable interface is accessible across the network boundary. The execution of arbitrary OS commands leads directly to full system compromise, allowing attackers to manipulate system binaries, intercept network traffic, establish persistent backdoors, or pivot deeper into internal network segments connected to the router."
}