CVE-2026-16095
Received Received - Intake

Out-of-Bounds Write in Shibby Tomato Firmware

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulDB

Description
A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation of the argument ct_tcp_timeout can lead to out-of-bounds write. The attack may be performed from remote. This project is superseded by FreshTomato.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2026-16095
EUVD
EUVD-2026-45370

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shibby tomato to 1.28_rt-n5x_mipsr2_build_124 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack out-of-bounds write flaw in Shibby Tomato firmware version 1.28 RT-N5x MIPSR2 Build 124. It occurs in the setup_conntrack function of the /sbin/rc file. The issue happens when the function processes TCP conntrack timeout values without proper bounds checking, leading to a buffer overflow when formatting data into a fixed 72-byte stack buffer. Attackers can manipulate the ct_tcp_timeout argument to trigger this overflow, potentially causing system instability.

Detection Guidance

Check if your Tomato firmware version is Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 by running 'nvram get os_version' or checking the web interface. Inspect the rc process for crashes during conntrack or firewall setup. Monitor system logs for buffer overflow errors or process instability.

Impact Analysis

This vulnerability may cause denial-of-service conditions by corrupting the rc process during conntrack or firewall setup. It could lead to system crashes or instability, particularly during boot time or network operations. While remote code execution was not demonstrated, the flaw could still disrupt router functionality if exploited locally or during boot.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a local or boot-time denial-of-service issue in Tomato firmware. It does not involve unauthorized data access, processing, or disclosure that would typically trigger GDPR or HIPAA violations.

Mitigation Strategies

Upgrade to a newer version of Tomato firmware, such as FreshTomato, which supersedes Shibby Tomato and addresses this issue. If upgrading is not possible, disable conntrack or firewall features temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16095. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart