Buffer Overflow Vulnerability in Shibby Tomato Router Firmware

CVE-2026-10065

What is CVE-2026-10065?

A vulnerability has been discovered in Shibby Tomato firmware version 1.28, specifically in the function get_ups_field located in the tomatodata.cgi file. This weakness allows an attacker to manipulate the Date argument, leading to a stack-based buffer overflow. Importantly, this issue can be exploited remotely, posing a significant risk to users of this outdated firmware. Users are advised that Shibby Tomato is no longer supported, and the project has been succeeded by FreshTomato, which may offer enhanced security and features.

References