CVE-2026-19036

CVE-2026-19036 is a command injection flaw in Shibby Tomato firmware, specifically in PPP configuration handling via manipulation of `/tmp/ppp/wanoptions`. The CVSS 7.2 rating tells you the technical severity—but it radically undersells the operational reality. Here is what matters: the Shibby Tomato project is dead. There will be no vendor patch. The vulnerability exists in the code as released, permanently. Your only remediation path is firmware migration to FreshTomato (the active fork), or device replacement. There is no security update coming. This matters more than the CVSS score because the vulnerability's location compounds the exposure. PPP handling is foundational networking code—the path your ISP credentials and connection parameters traverse. Compromising it places you at the traffic chokepoint for every device behind the router. This isn't a contained local bug; it's gateway logic with MITM potential affecting every downstream client. The binary reverse-engineering origin of this finding creates a significant blind spot: we see one injection point, but we don't know if similar unsanitized shell invocations exist elsewhere in the PPP handling code. The same architectural pattern that produced this flaw may be present in other code paths we haven't audited. FreshTomato inherited Shibby Tomato's codebase at a point in time—if they patched only this specific vector without addressing the underlying shell-invocation pattern in PPP handling, the next CVE in this family is inevitable, not speculative. The EPSS score of 0.02469 assumes active patching infrastructure that simply doesn't exist here. For abandoned firmware, the relevant metric is time-to-migration, not exploitation probability. The vulnerable population is fixed, non-renovating, and increasingly invisible to security tooling that tracks active firmware. Every day Shibby Tomato deployments persist, the practical risk doesn't decay—it accumulates, because no remediation event will ever reduce the attack surface. If you run Shibby Tomato: migrate to FreshTomato now, or retire the device. There is no patch. The window is already closed.

Reviewed through automated stages and approved by a human before publication.