CVE-2026-10069
Shibby Tomato miniupnpd resource consumption
- State
- Published
- Severity
- 8.7 High
- Published
- May 29, 2026
- Updated
- Jun 2, 2026
- Reserved
- May 29, 2026
Description
A vulnerability has been found in Shibby Tomato 1.28. The impacted element is an unknown function of the file usr/sbin/miniupnpd. Such manipulation leads to resource consumption. The attack may be launched remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:R | VulDB |
| 3.0 | 7.5 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:R | VulDB |
| 2.0 | 7.8 High | AV:N/AC:L/Au:N/C:N/I:N/A:C/E:ND/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
TomatoShibby |
|
References
- VDB-367155 | Shibby Tomato miniupnpd resource consumptionvdb-entry
- VDB-367155 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #818238 | Tomato by Shibby Tomato Firmware 1.28 Resource Exhaustionthird-party-advisory
- https://gitee.com/Fengyi-Wang/CVE/issues/IJD8SPissue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.