Which versions of Shibby Tomato are affected by CVE-2026-16097?

Shibby Tomato 1.28, a retired router firmware distribution, contains a critical remote code execution vulnerability (CVSS 8.7) affecting network infrastructure security.

How to fix or mitigate CVE-2026-16097?

Within 24 hours, identify all instances of Shibby Tomato 1.28 deployed in your network environment. Within 7 days, implement emergency network controls to restrict access to the scheduler function (limit to essential administrators only, enforce strong authentication, apply network segmentation), and disable the scheduler service if operationally unnecessary. Within 30 days, complete migration of all affected devices to FreshTomato (the official successor firmware) or decommission the hardware; if immediate migration is infeasible, maintain strict network isolation and deploy continuous monitoring of scheduler function activity for exploitation indicators.

Shibby Tomato CVE-2026-16097

Q: What is the CVSS score of CVE-2026-16097?

CVE-2026-16097 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-45372 HIGH

Buffer Overflow (CWE-119)

2026-07-18 cna@vuldb.com

GHSA-wvq6-2vpm-hch4

Buffer Overflow

8.7

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 18, 2026 - 12:31 vuln.today

CVE Published

Jul 18, 2026 - 12:17 cve.org

HIGH 8.7

DescriptionCVE.org

A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the function sub_42537C of the component Scheduler Name Handler. The manipulation of the argument a1 results in stack-based buffer overflow. It is possible to launch the attack remotely. This project is superseded by FreshTomato.

AnalysisAI

Stack-based buffer overflow in Shibby Tomato 1.28 router firmware lets an authenticated attacker corrupt memory through the Scheduler Name Handler (function sub_42537C) by supplying an overlong scheduler-name argument, enabling likely remote code execution on the device. The affected build is a niche, community-maintained MIPS router firmware distribution that has been retired and superseded by FreshTomato. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the VulDB-assigned CVSS 4.0 score is 8.7.