CVE-2026-10066
Stack-Based Buffer Overflow in Shibby Tomato
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| shibby_tomato | tomato | to 1.28 (inc) |
| shibby | tomato | to 1.28 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-10066 is a stack-based buffer overflow vulnerability found in the Tomato by Shibby firmware version 1.28, specifically in the UPS Service component's function sub_9068 within the tomatoups.cgi file.
The vulnerability arises because the function does not properly enforce length limits when writing data to a 64-byte stack buffer. An attacker can send a specially crafted ITEMP value of 64 bytes, which overwrites the buffer and corrupts adjacent stack data, including the terminating NUL byte.
This stack out-of-bounds write can cause a segmentation fault (SIGSEGV), leading to a crash of the process and potentially causing denial of service.
How can this vulnerability impact me? :
This vulnerability can be exploited remotely to cause a stack-based buffer overflow, which may lead to a segmentation fault and crash the affected process.
The primary impact is a denial of service condition, where the UPS service on the affected device becomes unavailable due to the crash.
Because the affected products are no longer supported by the maintainer, there may be no official patches or fixes available, increasing the risk if the device remains in use.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for TCP connections to port 3551, which is used by the UPS service component in the affected Tomato firmware.
Specifically, detection involves identifying unusually long or malformed ITEMP values sent to the tomatoups.cgi service, as the vulnerability is triggered by a 64-byte attacker-controlled ITEMP input.
Commands to help detect this include using network packet capture tools such as tcpdump or Wireshark to filter traffic on port 3551 and inspect payload sizes.
- tcpdump -i <interface> tcp port 3551 -w capture.pcap
- tshark -r capture.pcap -Y 'tcp.port == 3551 && frame.len > 100'
Additionally, monitoring system logs for segmentation faults (SIGSEGV) related to the tomatoups.cgi process may indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing the use of Shibby Tomato firmware up to version 1.28, as the vulnerability affects unsupported products.
Since the project is superseded by FreshTomato, upgrading to FreshTomato or another supported firmware version is strongly recommended.
In the short term, restricting network access to TCP port 3551 on affected devices can help prevent remote exploitation.
- Implement firewall rules to block incoming traffic on port 3551 from untrusted sources.
- Monitor the UPS service process for crashes or abnormal behavior and restart or isolate affected devices if exploitation is suspected.