CVE-2026-15546

Name of the Vulnerable Software and Affected Versions Shibby Tomato versions prior to 1.28.0000

Description An OS command injection flaw exists in the sub 2D568() function of the start jffs2 component. This issue allows remote exploitation by manipulating the jffs2 exec argument. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device.

Recommendations Update to a version newer than 1.28.0000. As a temporary workaround, restrict access to the start jffs2 component to minimize the risk of exploitation.