EUVD-2026-33467
GHSA-xv8j-c5vv-vvmg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt memory in the ripd daemon via the rip_zebra_read_ipv4 function in the Zserv Handler component. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - so no vendor patch will be released. CVSS 4.0 score of 7.4 reflects network attack vector with low complexity but requires low-privilege access (PR:L) per the vector.
Technical ContextAI
Shibby Tomato is a community-maintained fork of the Tomato router firmware (Linux-based) for consumer routers, which has since been superseded by FreshTomato. The vulnerable component is ripd, the Routing Information Protocol daemon, which is part of the Quagga/Zebra routing suite bundled in the firmware at /usr/sbin/ripd. The Zserv Handler is the inter-process communication channel between Zebra and routing daemons such as ripd. CWE-121 (Stack-Based Buffer Overflow) means the rip_zebra_read_ipv4 function writes attacker-controlled data past the bounds of a fixed-size stack buffer, potentially overwriting the return address and enabling control-flow hijack on the embedded MIPS/ARM router platform.
RemediationAI
No vendor-released patch identified at time of analysis - Shibby Tomato is end-of-life and will not receive fixes. The primary remediation is to migrate affected routers to the actively maintained FreshTomato firmware, which supersedes Shibby Tomato. As compensating controls until migration, disable the RIP routing daemon entirely via the Tomato web UI (Advanced → Routing → set mode to something other than RIPv1/RIPv2), which removes the attack surface entirely at the cost of losing dynamic routing on that device; if RIP must remain enabled, restrict ripd to trusted internal VLANs only and firewall UDP/520 from untrusted networks and the WAN; and ensure the Zserv local socket is not exposed to untrusted users on the device. Track the issue via https://vuldb.com/vuln/367301.
OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell comma
OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operat
OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with adm
Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated rem
Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the
OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary oper
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a s
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticat
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corru
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today