Stack-Based Buffer Overflow in Shibby Tomato apcupsd

Executive Summary

CVE-2026-15544 is a stack-based buffer overflow vulnerability found in the Tomato by Shibby firmware, specifically affecting the apcupsd CGI programs including tomatodata.cgi, tomatoups.cgi, and multimon.cgi.

The flaw exists in the getupsvar() function, where an unbounded sscanf call with the "%s" format writes unlimited input bytes into a fixed 64-byte stack buffer without checking the size limits. The buffer size parameter is ignored.

The data causing this overflow comes from the apcupsd daemon's TCP response on port 3551, affecting many UPS status fields. This vulnerability can be exploited remotely on the LAN side when remote UPS monitoring is configured.

Exploitation can cause crashes (SIGSEGV) and potentially allow remote code execution by overwriting the program counter with attacker-controlled data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service through application crashes caused by the stack-based buffer overflow.

More critically, it may allow an attacker to execute arbitrary code remotely on the affected device by controlling the program counter, potentially leading to full system compromise.

Since the attack surface is on the LAN side when remote UPS monitoring is enabled, attackers within the local network could exploit this vulnerability to disrupt services or gain unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the apcupsd CGI programs in Shibby Tomato firmware, specifically the getupsvar() function which processes TCP responses from the apcupsd daemon on port 3551.

To detect this vulnerability on your network or system, you can monitor traffic on TCP port 3551 for suspicious or malformed responses from the apcupsd daemon that might trigger the buffer overflow.

Since the vulnerability involves unbounded sscanf calls in the CGI scripts, you can also check the version of the Tomato firmware to see if it is up to 1.28.0000, which is affected.

Specific commands to detect or test this vulnerability are not explicitly provided in the resources, but you might consider using network monitoring tools like tcpdump or Wireshark to capture traffic on port 3551, for example:

• tcpdump -i <interface> port 3551

Additionally, you could attempt to emulate or simulate the attack using a controlled apcupsd server sending crafted responses to the vulnerable CGI scripts to observe crashes or abnormal behavior.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting access to the apcupsd monitoring service on TCP port 3551, especially from untrusted LAN or WAN sources.

Since the vulnerability is in Shibby Tomato firmware up to version 1.28.0000, upgrading to a newer firmware version such as FreshTomato, which supersedes Shibby Tomato, is recommended.

Limiting or disabling remote UPS monitoring functionality that uses the vulnerable CGI programs (tomatodata.cgi, tomatoups.cgi, multimon.cgi) can reduce the attack surface.

Applying network-level controls such as firewall rules to block or restrict access to port 3551 can help prevent exploitation.

Useful 0 Not Useful 0