Skip to main content

Shibby Tomato CVE-2026-15545

| EUVDEUVD-2026-43309 HIGH
Out-of-bounds Write (CWE-787)
2026-07-13 VulDB GHSA-x2mq-9fxf-86m4
Memory Corruption Buffer Overflow Tomato
7.4
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable CGI with low complexity and no user interaction, but requires a low-privilege authenticated web session (PR:L); out-of-bounds write yields high C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 13, 2026 - 09:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 13, 2026 - 09:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 13, 2026 - 09:22 vuln.today
cvss_changed
CVSS changed
Jul 13, 2026 - 09:22 NVD
8.7 (HIGH) 7.4 (HIGH)
Analysis Generated
Jul 13, 2026 - 09:01 vuln.today
CVE Published
Jul 13, 2026 - 08:00 cve.org
HIGH 8.7

DescriptionCVE.org

A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file www/apcupsd/tomatodata.cgi of the component apcupsd. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.

AnalysisAI

Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated remote users corrupt memory through the apcupsd web component. The flaw sits in the main() function of www/apcupsd/tomatodata.cgi, where crafted input reaches an out-of-bounds write (CWE-787) that can crash the CGI or potentially execute code on the router. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach router web UI over network
Delivery
Authenticate with low-privilege credentials
Exploit
Send crafted request to tomatodata.cgi
Execution
Trigger out-of-bounds write in main()
Impact
Corrupt memory / execute code on router
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network access to the router's web administration interface AND a low-privilege authenticated session (CVSS PR:L), plus the apcupsd/UPS component being present and reachable so that the www/apcupsd/tomatodata.cgi endpoint can be invoked. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privilege authenticated session on the router's web interface - obtained via weak/default credentials, credential reuse, or an exposed management page - sends a crafted request to www/apcupsd/tomatodata.cgi. The malformed parameters trigger the out-of-bounds write in main(), crashing the daemon or corrupting memory to potentially run attacker code on the router. …
Remediation No vendor-released patch identified at time of analysis, and the Shibby Tomato project is end-of-life (superseded by FreshTomato), so the primary remediation is migration: replace Shibby Tomato with an actively maintained firmware such as FreshTomato (or an equivalent supported alternative) that carries current fixes, accepting the effort of a firmware reflash and configuration migration. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct a complete inventory of Shibby Tomato deployments and document all systems running firmware version 1.28.0000 or earlier in production. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tomato

View all
CVE-2026-10124 HIGH POC
7.4 May 30

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt me
CVE-2026-15544 HIGH POC
7.4 Jul 13

Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the
CVE-2026-10873 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary oper
CVE-2026-10870 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
CVE-2026-10872 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
CVE-2026-10871 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
CVE-2013-7379 MEDIUM POC
6.8 May 16

The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a s
CVE-2026-15548 HIGH
7.4 Jul 13

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, l
CVE-2026-15547 LOW POC
2.1 Jul 13

OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrar
CVE-2026-15546 LOW POC
2.1 Jul 13

OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers t

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Memory Corruption

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-15545 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy