Compliance Impact

The vulnerability is a stack-based buffer overflow in Shibby Tomato 1.28 that can lead to process crashes, data corruption, or control-flow hijacking. Such impacts on data integrity and system availability could potentially affect compliance with standards like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability.

However, the affected product is no longer supported by the maintainer and is superseded by FreshTomato, which may limit the practical compliance risk if the vulnerable firmware is no longer in use.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-10065 is a stack-based buffer overflow vulnerability found in the Shibby Tomato firmware version 1.28, specifically in the get_ups_field function within the tomatodata.cgi file.

The vulnerability arises because the function copies a DATE field from a UPS response into a fixed 256-byte stack buffer without checking if the input exceeds this size.

If an attacker sends a DATE field longer than 256 bytes, it causes an out-of-bounds write on the stack, potentially leading to process crashes, data corruption, or even control-flow hijacking.

This attack can be launched remotely by manipulating the DATE argument.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including crashing the affected process, corrupting data, or allowing an attacker to hijack the control flow of the system.

Such control-flow hijacking could enable execution of arbitrary code, potentially leading to unauthorized access or control over the device running the vulnerable firmware.

Since the vulnerability can be exploited remotely, it increases the risk of attacks without requiring physical access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring or testing the response of the vulnerable device's tomatodata.cgi component, specifically the get_ups_field function that processes the DATE field from UPS responses.

One practical detection method is to simulate or observe a UPS server response with an abnormally long DATE field (exceeding 256 bytes) and check if the device crashes, exhibits data corruption, or abnormal behavior indicating a stack-based buffer overflow.

Since the vulnerability is triggered by a long DATE field in the UPS response, network monitoring tools can be used to capture and analyze traffic to the tomatodata.cgi endpoint for suspiciously large DATE fields.

• Use curl or wget to send crafted HTTP requests to the vulnerable tomatodata.cgi endpoint with an oversized DATE parameter to test for overflow behavior.
• Example command to test the endpoint (replace <target_ip>):
• curl -v "http://<target_ip>/www/apcupsd/tomatodata.cgi?DATE=$(python3 -c 'print("A"*512)')"
• Monitor the device for crashes or abnormal responses after sending the request.
• Use network packet capture tools like tcpdump or Wireshark to inspect traffic to the tomatodata.cgi endpoint for unusually large DATE fields.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding exposure of the vulnerable Tomato 1.28 device to untrusted networks, especially blocking access to the tomatodata.cgi endpoint.

Since the affected product is no longer supported and has been superseded by FreshTomato, the best long-term mitigation is to upgrade to a supported firmware version such as FreshTomato.

If upgrading is not immediately possible, restrict network access to the vulnerable device by firewall rules or network segmentation to prevent remote exploitation.

• Block or restrict HTTP access to /www/apcupsd/tomatodata.cgi on the device.
• Monitor device logs and network traffic for suspicious activity targeting the UPS DATE field.
• Plan and execute migration to FreshTomato or another supported firmware to eliminate the vulnerability.

Useful 0 Not Useful 0