Buffer Overflow Vulnerability in Shibby Tomato Router Firmware

CVE-2026-10067

What is CVE-2026-10067?

A stack-based buffer overflow vulnerability has been identified in Shibby Tomato Firmware version 1.28, specifically within the function sub_90F0 of the multimon.cgi file. This flaw allows for remote exploitation, meaning that attackers can trigger the vulnerability without local access. The affected firmware version is no longer supported by its maintainer, which increases the risk for users. This vulnerability underscores the importance of updating to supported firmware versions, such as FreshTomato, to ensure ongoing security and protection against potential attacks.

References