Which versions of Shibby Tomato are affected by CVE-2026-15548?

Shibby Tomato router firmware (versions through 1.28.0000) contains a stack-based buffer overflow enabling remote code execution by authenticated users of the web administration interface.

How to fix or mitigate CVE-2026-15548?

Within 24 hours: inventory all Shibby Tomato deployments (versions ≤1.28.0000), disable remote web administration access, and restrict local management interface to trusted networks only. Within 7 days: begin proof-of-concept migration testing to FreshTomato (the maintained successor fork) or alternative firmware on non-production equipment. Within 30 days: complete firmware migration across all affected routers, or implement network segmentation and multi-factor authentication on management access for any legacy systems that cannot be upgraded, with documented end-of-life dates.

Shibby Tomato CVE-2026-15548

Q: What is the CVSS score of CVE-2026-15548?

CVE-2026-15548 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-43322 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-13 VulDB

Buffer Overflow Stack Overflow Tomato Shibby

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Web-reachable httpd (AV:N/AC:L) requiring a low-privilege authenticated session (PR:L, no UI), with a stack overflow enabling code execution and full C/I/A compromise on the same device (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:13 vuln.today

CVSS changed

Jul 13, 2026 - 10:22 NVD

8.7 (HIGH) 7.4 (HIGH)

CVE Published

Jul 13, 2026 - 08:45 cve.org

HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.

AnalysisAI

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, low-privileged attacker to corrupt the stack of the embedded web server (/usr/sbin/httpd) via the DNS List Rendering function sub_407220, potentially achieving arbitrary code execution on the router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low-level authentication (PR:L) to the web administration interface. VulDB assigns an exploit maturity of Proof-of-Concept, meaning publicly available exploit code exists, though it is not listed in CISA KEV and no active exploitation is confirmed. Notably, the Tomato project by Shibby is discontinued and superseded by FreshTomato, so no first-party fix is expected.

Technical ContextAI

Tomato is a Linux-based aftermarket firmware for consumer/SOHO routers (Broadcom-based devices), and 'Shibby' is one of its long-running community forks. The vulnerable code lives in the firmware's custom HTTP daemon at /usr/sbin/httpd, which serves the router's web management UI. The specific defect is a stack-based buffer overflow (CWE-121) in the internal routine identified through reverse engineering as sub_407220, tied to 'DNS List Rendering' - logic that formats/serves a list of DNS entries. In CWE-121, fixed-size stack buffers are written without adequate bounds checking, so oversized attacker-influenced input overwrites adjacent stack memory including saved return addresses; on the MIPS/ARM embedded targets typical of Tomato this can lead to control-flow hijack. The CPE cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:* confirms the affected component is the Shibby Tomato application/firmware across all versions up to the fixed range boundary.

RemediationAI

No vendor-released patch identified at time of analysis - the Shibby Tomato project is discontinued and explicitly superseded by FreshTomato, so the primary remediation is to migrate affected routers to actively maintained FreshTomato firmware (or the manufacturer's supported firmware) rather than waiting for a Shibby fix. Until migration, apply compensating controls: restrict access to the router's web administration interface (httpd) to trusted management VLANs/hosts and disable remote/WAN administration entirely so the DNS List Rendering endpoint is not exposed to untrusted networks - trade-off is loss of remote management convenience. Enforce strong, unique admin credentials to raise the bar on the PR:L (authenticated) precondition, and place the device behind a firewall or ACL that blocks inbound access to the admin HTTP port. Monitor the device for crashes or reboots that could indicate exploitation attempts. Track VulDB (https://vuldb.com/vuln/377898) and the Gitee issue (https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5R) for any community patch, but do not assume one will be issued for this retired firmware.