CVE-2026-15546
published 2026-07-13CVE-2026-15546: A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing…
PriorityP352medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
1.77%
77.1th percentile
A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
| shibby | tomato | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A security flaw has been discovered in Shibby Tomato up to 1.28.0000.
ghsa_unreviewed·2026-07-13
CVE-2026-15546 [LOW] CWE-77 A security flaw has been discovered in Shibby Tomato up to 1.28.0000.
A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
VulDB
Shibby Tomato up to 1.28.0000 start_jffs2 sub_2D568 jffs2_exec os command injection (IJTQ5O)
vuldb·2026-07-12
CVE-2026-15546 [CRITICAL] Shibby Tomato up to 1.28.0000 start_jffs2 sub_2D568 jffs2_exec os command injection (IJTQ5O)
A vulnerability was found in Shibby Tomato up to 1.28.0000. It has been rated as critical. Affected by this issue is the function sub_2D568 of the component start_jffs2. Performing a manipulation of the argument jffs2_exec results in os command injection.
This vulnerability is known as CVE-2026-15546. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
This project is superseded by FreshTomato.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-13
Published