Which versions of Shibby Tomato are affected by CVE-2026-15545?

Shibby Tomato router firmware (versions ≤1.28.0000) contains a memory corruption vulnerability with publicly available exploit code that allows authenticated attackers to remotely crash devices or…

Is there a public PoC exploit available for CVE-2026-15545?

Yes, a public proof-of-concept exploit is available for CVE-2026-15545. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-15545?

Within 24 hours, conduct a complete inventory of Shibby Tomato deployments and document all systems running firmware version 1.28.0000 or earlier in production. Within 7 days, implement immediate network segmentation to restrict access to the vulnerable apcupsd web component via firewall rules and access controls, and disable the apcupsd component if operationally feasible. Within 30 days, develop and execute a device replacement strategy; evaluate migration to FreshTomato (the officially supported successor) or alternative router vendors with active security patch support, targeting completion within 90 days.

Shibby Tomato CVE-2026-15545

Q: What is the CVSS score of CVE-2026-15545?

CVE-2026-15545 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43309 HIGH

Out-of-bounds Write (CWE-787)

2026-07-13 VulDB

GHSA-x2mq-9fxf-86m4

Buffer Overflow Memory Corruption Tomato Shibby

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable CGI with low complexity and no user interaction, but requires a low-privilege authenticated web session (PR:L); out-of-bounds write yields high C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 09:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 13, 2026 - 09:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 13, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Jul 13, 2026 - 09:22 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jul 13, 2026 - 09:01 vuln.today

CVE Published

Jul 13, 2026 - 08:00 cve.org

HIGH 8.7

DescriptionCVE.org

A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file www/apcupsd/tomatodata.cgi of the component apcupsd. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.

AnalysisAI

Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated remote users corrupt memory through the apcupsd web component. The flaw sits in the main() function of www/apcupsd/tomatodata.cgi, where crafted input reaches an out-of-bounds write (CWE-787) that can crash the CGI or potentially execute code on the router. Publicly available exploit code exists (via VulDB/Gitee), but there is no confirmed active exploitation; note that this project has been superseded by FreshTomato and is effectively end-of-life.

Technical ContextAI

Shibby Tomato is a community fork of the Tomato open-source firmware for consumer/SOHO routers (Broadcom-based), providing a web administration interface built from CGI programs. The affected code, www/apcupsd/tomatodata.cgi, is a CGI handler tied to apcupsd - the APC UPS daemon integration that exposes UPS status data through the web UI. The root cause is CWE-787 (Out-of-bounds Write): the main() routine writes past the bounds of an allocated buffer, typical of C CGI programs that copy attacker-influenced request parameters into fixed-size stack or heap buffers without adequate bounds checking. The single CPE, cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*, identifies Shibby's Tomato distribution as the affected product family.

RemediationAI

No vendor-released patch identified at time of analysis, and the Shibby Tomato project is end-of-life (superseded by FreshTomato), so the primary remediation is migration: replace Shibby Tomato with an actively maintained firmware such as FreshTomato (or an equivalent supported alternative) that carries current fixes, accepting the effort of a firmware reflash and configuration migration. Until migration is possible, apply compensating controls: disable the apcupsd feature/UPS monitoring in the web UI if UPS integration is not used, which removes the vulnerable tomatodata.cgi code path at the cost of losing UPS status reporting; restrict access to the router's web administration interface to trusted management hosts/VLANs and never expose it to the WAN, since exploitation requires reaching the CGI over the network; and enforce strong, unique admin credentials because the flaw requires an authenticated (PR:L) session, so limiting who holds valid logins directly reduces exposure. Consult the VulDB references (https://vuldb.com/cve/CVE-2026-15545) for tracking updates.