Which versions of Tomato are affected by CVE-2026-15544?

Shibby Tomato router firmware through version 1.28.0000 contains a remote authenticated command execution vulnerability (CVE-2026-15544, CVSS 8.7) in the apcupsd CGI handler that allows logged-in…

Is there a public PoC exploit available for CVE-2026-15544?

Yes, a public proof-of-concept exploit is available for CVE-2026-15544. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-15544?

Within 24 hours: Inventory all devices running Tomato firmware ≤1.28.0000 and immediately restrict administrative access through network segmentation and firewall rules; contact Shibby project for interim mitigation guidance. Within 7 days: Disable the apcupsd service entirely if UPS monitoring is not operationally required; implement egress monitoring to detect exploitation attempts targeting the tomatodata.cgi endpoint; review device access logs for unauthorized logins. Within 30 days: Monitor Shibby project security advisories for patched firmware versions; conduct controlled firmware upgrade pilot on non-critical devices; develop replacement strategy for devices where firmware updates are not viable.

Tomato CVE-2026-15544

Q: What is the CVSS score of CVE-2026-15544?

CVE-2026-15544 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43304 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-13 VulDB

GHSA-hp2q-5cpp-5m3x

Buffer Overflow Stack Overflow Tomato Shibby

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Jul 13, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 13, 2026 - 08:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 13, 2026 - 08:21 vuln.today

CVE Published

Jul 13, 2026 - 07:30 cve.org

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This manipulation of the argument Field causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

AnalysisAI

Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the getupsvar function in the apcupsd CGI handler (www/apcupsd/tomatodata.cgi) fails to bound the Field argument, producing a stack-based buffer overflow (CWE-121). A logged-in user can send a crafted request to corrupt the stack and hijack control flow with full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (VulDB), though there is no evidence of active exploitation; the CVSS 4.0 score is 8.7 with an E:P (proof-of-concept) exploit-maturity flag.