CVE-2026-10065
Stack-Based Buffer Overflow in Shibby Tomato Firmware
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shibby_tomato | 1.28 | * |
| shibby | tomato | 1.28 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-10065 is a stack-based buffer overflow vulnerability found in the Shibby Tomato firmware version 1.28, specifically in the get_ups_field function within the tomatodata.cgi file.
The vulnerability arises because the function copies a DATE field from a UPS response into a fixed 256-byte stack buffer without checking if the input exceeds this size.
If an attacker sends a DATE field longer than 256 bytes, it causes an out-of-bounds write on the stack, potentially leading to process crashes, data corruption, or even control-flow hijacking.
This attack can be launched remotely by manipulating the DATE argument.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including crashing the affected process, corrupting data, or allowing an attacker to hijack the control flow of the system.
Such control-flow hijacking could enable execution of arbitrary code, potentially leading to unauthorized access or control over the device running the vulnerable firmware.
Since the vulnerability can be exploited remotely, it increases the risk of attacks without requiring physical access.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring or testing the response of the vulnerable device's tomatodata.cgi component, specifically the get_ups_field function that processes the DATE field from UPS responses.
One practical detection method is to simulate or observe a UPS server response with an abnormally long DATE field (exceeding 256 bytes) and check if the device crashes, exhibits data corruption, or abnormal behavior indicating a stack-based buffer overflow.
Since the vulnerability is triggered by a long DATE field in the UPS response, network monitoring tools can be used to capture and analyze traffic to the tomatodata.cgi endpoint for suspiciously large DATE fields.
- Use curl or wget to send crafted HTTP requests to the vulnerable tomatodata.cgi endpoint with an oversized DATE parameter to test for overflow behavior.
- Example command to test the endpoint (replace <target_ip>):
- curl -v "http://<target_ip>/www/apcupsd/tomatodata.cgi?DATE=$(python3 -c 'print("A"*512)')"
- Monitor the device for crashes or abnormal responses after sending the request.
- Use network packet capture tools like tcpdump or Wireshark to inspect traffic to the tomatodata.cgi endpoint for unusually large DATE fields.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding exposure of the vulnerable Tomato 1.28 device to untrusted networks, especially blocking access to the tomatodata.cgi endpoint.
Since the affected product is no longer supported and has been superseded by FreshTomato, the best long-term mitigation is to upgrade to a supported firmware version such as FreshTomato.
If upgrading is not immediately possible, restrict network access to the vulnerable device by firewall rules or network segmentation to prevent remote exploitation.
- Block or restrict HTTP access to /www/apcupsd/tomatodata.cgi on the device.
- Monitor device logs and network traffic for suspicious activity targeting the UPS DATE field.
- Plan and execute migration to FreshTomato or another supported firmware to eliminate the vulnerability.