CVE-2026-19035

Name of the Vulnerable Software and Affected Versions Shibby Tomato version 1.28.0000

Description An OS command injection flaw exists in the new qoslimit start() function located in the /etc/qoslimit file. A remote attacker can trigger this issue by manipulating the new qoslimit enable argument. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device.

Recommendations As a temporary workaround, consider restricting access to the new qoslimit start() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.