Executive Summary

CVE-2026-10066 is a stack-based buffer overflow vulnerability found in the Tomato by Shibby firmware version 1.28, specifically in the UPS Service component's function sub_9068 within the tomatoups.cgi file.

The vulnerability arises because the function does not properly enforce length limits when writing data to a 64-byte stack buffer. An attacker can send a specially crafted ITEMP value of 64 bytes, which overwrites the buffer and corrupts adjacent stack data, including the terminating NUL byte.

This stack out-of-bounds write can cause a segmentation fault (SIGSEGV), leading to a crash of the process and potentially causing denial of service.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited remotely to cause a stack-based buffer overflow, which may lead to a segmentation fault and crash the affected process.

The primary impact is a denial of service condition, where the UPS service on the affected device becomes unavailable due to the crash.

Because the affected products are no longer supported by the maintainer, there may be no official patches or fixes available, increasing the risk if the device remains in use.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for TCP connections to port 3551, which is used by the UPS service component in the affected Tomato firmware.

Specifically, detection involves identifying unusually long or malformed ITEMP values sent to the tomatoups.cgi service, as the vulnerability is triggered by a 64-byte attacker-controlled ITEMP input.

Commands to help detect this include using network packet capture tools such as tcpdump or Wireshark to filter traffic on port 3551 and inspect payload sizes.

• tcpdump -i <interface> tcp port 3551 -w capture.pcap
• tshark -r capture.pcap -Y 'tcp.port == 3551 && frame.len > 100'

Additionally, monitoring system logs for segmentation faults (SIGSEGV) related to the tomatoups.cgi process may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include discontinuing the use of Shibby Tomato firmware up to version 1.28, as the vulnerability affects unsupported products.

Since the project is superseded by FreshTomato, upgrading to FreshTomato or another supported firmware version is strongly recommended.

In the short term, restricting network access to TCP port 3551 on affected devices can help prevent remote exploitation.

• Implement firewall rules to block incoming traffic on port 3551 from untrusted sources.
• Monitor the UPS service process for crashes or abnormal behavior and restart or isolate affected devices if exploitation is suspected.

Useful 0 Not Useful 0