Skip to main content

Shibby Tomato EUVDEUVD-2026-43322

| CVE-2026-15548 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-07-13 VulDB
Stack Overflow Buffer Overflow Tomato
7.4
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Web-reachable httpd (AV:N/AC:L) requiring a low-privilege authenticated session (PR:L, no UI), with a stack overflow enabling code execution and full C/I/A compromise on the same device (S:U).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jul 13, 2026 - 11:13 vuln.today
CVSS changed
Jul 13, 2026 - 10:22 NVD
8.7 (HIGH) 7.4 (HIGH)
CVE Published
Jul 13, 2026 - 08:45 cve.org
HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.

AnalysisAI

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, low-privileged attacker to corrupt the stack of the embedded web server (/usr/sbin/httpd) via the DNS List Rendering function sub_407220, potentially achieving arbitrary code execution on the router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low-level authentication (PR:L) to the web administration interface. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Reach router web admin interface (LAN/WAN)
Delivery
Authenticate with low-privilege credentials
Exploit
Send crafted DNS List request
Install
Overflow stack buffer in sub_407220
C2
Overwrite saved return address
Execute
Execute arbitrary code in httpd context
Impact
Compromise router / pivot to network
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to the Shibby Tomato web administration daemon (/usr/sbin/httpd) and, per CVSS 4.0 PR:L, a low-privileged authenticated session on that web interface - an attacker must be able to invoke the DNS List Rendering code path (function sub_407220) with attacker-controlled input. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are moderately consistent but point to a targeted rather than mass-exploitation risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the router's web admin interface and holds low-privilege credentials (or exploits weak/default logins common on SOHO routers) sends a crafted request to the DNS List Rendering functionality, supplying an oversized value that overflows a fixed stack buffer in sub_407220 within /usr/sbin/httpd. The overflow overwrites the saved return address, allowing the attacker to hijack control flow and execute arbitrary code on the router with the daemon's privileges. …
Remediation No vendor-released patch identified at time of analysis - the Shibby Tomato project is discontinued and explicitly superseded by FreshTomato, so the primary remediation is to migrate affected routers to actively maintained FreshTomato firmware (or the manufacturer's supported firmware) rather than waiting for a Shibby fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Shibby Tomato deployments (versions ≤1.28.0000), disable remote web administration access, and restrict local management interface to trusted networks only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tomato

View all
CVE-2026-10124 HIGH POC
7.4 May 30

Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt me
CVE-2026-15545 HIGH POC
7.4 Jul 13

Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated rem
CVE-2026-15544 HIGH POC
7.4 Jul 13

Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the
CVE-2026-10873 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary oper
CVE-2026-10870 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
CVE-2026-10872 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
CVE-2026-10871 HIGH POC
7.3 Jun 04

OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitra
CVE-2013-7379 MEDIUM POC
6.8 May 16

The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a s
CVE-2026-15547 LOW POC
2.1 Jul 13

OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrar
CVE-2026-15546 LOW POC
2.1 Jul 13

OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers t

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.0
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Stack Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.0
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Share

EUVD-2026-43322 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy