EUVD-2026-45371
GHSA-3pw4-v8p8-wpvg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable webmon handler with low attack complexity but requires an authenticated session (PR:L), and a successful stack overflow yields full code execution, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub_40BB50 of the file /proc/webmon_recent_domains. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This project is superseded by FreshTomato.
AnalysisAI
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Technical ContextAI
Tomato is a Linux-based alternative firmware for consumer/SOHO routers; the Shibby fork targets Broadcom-based devices such as the RT-N5x family running a MIPSR2 architecture. The vulnerable code path is the web-monitoring (webmon) feature, which records recently visited domains and exposes them via the /proc/webmon_recent_domains procfs entry; the function sub_40BB50 (an IDA-style address label indicating analysis of a stripped binary) parses or formats this data into a fixed-size stack buffer. CWE-121 (Stack-based Buffer Overflow) is the root cause: attacker-influenced input is copied without adequate bounds checking, overwriting the return address or adjacent stack variables. On MIPS embedded targets that typically lack modern exploit mitigations (no ASLR/DEP hardening in many builds), such overflows are frequently exploitable for control-flow hijack.
RemediationAI
No vendor-released patch identified at time of analysis; because Shibby Tomato is discontinued and explicitly superseded by FreshTomato, the primary remediation is to migrate affected RT-N5x devices to a currently maintained firmware such as FreshTomato (or the OEM/OpenWrt firmware) that does not contain this defect. As compensating controls until migration: disable the web-monitoring (webmon) feature so the vulnerable /proc/webmon_recent_domains handler is not populated/exercised (trade-off: loss of domain-visit logging); restrict access to the router management/web interface to trusted management VLANs or hosts and never expose it to the WAN (trade-off: remote administration becomes harder); and enforce strong, unique admin credentials plus session controls to raise the bar on the PR:L authentication prerequisite. Reference the VulDB entry at https://vuldb.com/cve/CVE-2026-16096 for tracking. Do not rely on a future official patch for this fork.
OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell comma
OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operat
OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with adm
Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt me
Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated rem
Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the
OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary oper
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a s
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corru
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today