Tomato
Monthly
OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell commands on the underlying router Linux OS. The vulnerability resides in function sub_40F88C, which passes the ppp_custom argument from /tmp/ppp/wanoptions into a system call without sanitizing shell metacharacters. A public proof-of-concept exploit is available on Gitee, and because this project is abandoned - officially superseded by FreshTomato - no patch will be released, making affected deployments permanently vulnerable without firmware migration.
OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operating system commands via the `new_qoslimit_enable` argument passed to the `new_qoslimit_start` function in `/etc/qoslimit`. Exploitation requires high-privilege (admin-level) credentials, but a proof-of-concept is publicly available on Gitee. The project has been officially superseded by FreshTomato, meaning no vendor patch is expected and affected devices will remain permanently unpatched.
OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with administrative access to execute arbitrary operating system commands on the affected router. The vulnerable function new_qoslimit_stop in /tmp/qoslimittc_stop.sh accepts a wan_iface argument that is passed unsanitized into a shell command, yielding full system-level code execution. A public proof-of-concept advisory has been disclosed on Gitee; no vendor patch is expected because Shibby Tomato is end-of-life, formally superseded by FreshTomato.
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.
Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, low-privileged attacker to corrupt the stack of the embedded web server (/usr/sbin/httpd) via the DNS List Rendering function sub_407220, potentially achieving arbitrary code execution on the router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low-level authentication (PR:L) to the web administration interface. VulDB assigns an exploit maturity of Proof-of-Concept, meaning publicly available exploit code exists, though it is not listed in CISA KEV and no active exploitation is confirmed. Notably, the Tomato project by Shibby is discontinued and superseded by FreshTomato, so no first-party fix is expected.
Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated remote users corrupt memory through the apcupsd web component. The flaw sits in the main() function of www/apcupsd/tomatodata.cgi, where crafted input reaches an out-of-bounds write (CWE-787) that can crash the CGI or potentially execute code on the router. Publicly available exploit code exists (via VulDB/Gitee), but there is no confirmed active exploitation; note that this project has been superseded by FreshTomato and is effectively end-of-life.
Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the getupsvar function in the apcupsd CGI handler (www/apcupsd/tomatodata.cgi) fails to bound the Field argument, producing a stack-based buffer overflow (CWE-121). A logged-in user can send a crafted request to corrupt the stack and hijack control flow with full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (VulDB), though there is no evidence of active exploitation; the CVSS 4.0 score is 8.7 with an E:P (proof-of-concept) exploit-maturity flag.
OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary operating system commands by manipulating input to the rstats_path function within the /bin/rstats binary exposed via the Web UI. Publicly available exploit code exists per the Gitee advisory disclosed through VulDB, and the affected project is end-of-life - superseded by FreshTomato - meaning no upstream vendor patch is forthcoming. CVSS 4.0 base score is 7.3 with high privileges required but high confidentiality, integrity, and availability impact on the router.
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_vpnserver function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - meaning no upstream patch is forthcoming. The CVSS 4.0 score of 7.3 reflects high impact on confidentiality, integrity, and availability, but high privileges are required to trigger the flaw.
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary shell commands by manipulating the ipv6_6rd_borderrelay argument processed by the start_6rd_tunnel function in /sbin/rc via the Web UI. Publicly available exploit code exists per VulDB disclosure, and the project is end-of-life - superseded by FreshTomato - meaning no upstream fix is expected.
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_dhcpc function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists per the VulDB advisory. The project has been discontinued and superseded by FreshTomato, meaning no upstream fix from the original maintainer is expected.
Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt memory in the ripd daemon via the rip_zebra_read_ipv4 function in the Zserv Handler component. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - so no vendor patch will be released. CVSS 4.0 score of 7.4 reflects network attack vector with low complexity but requires low-privilege access (PR:L) per the vector.
OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrary commands on the underlying router OS by manipulating the cifs1 or cifs2 arguments passed to the CIFS Mount Handler function sub_2D048. A publicly available proof-of-concept exploit exists on Gitee, lowering the barrier to exploitation. The risk is compounded by the fact that Shibby Tomato is an end-of-life project with no active maintenance, superseded by FreshTomato, meaning no patch is forthcoming from the original vendor.
OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the jffs2_exec argument in the start_jffs2 component's sub_2D568 function. A publicly available proof-of-concept exploit exists on Gitee, confirming exploitability beyond theoretical analysis. The project is officially abandoned and superseded by FreshTomato, meaning no vendor patch will ever be released - remediation requires migrating to supported firmware.
The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows remote attackers to bypass authentication via a string in. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available.
OS command injection in Shibby Tomato 1.28.0000 allows network-connected administrators to execute arbitrary shell commands on the underlying router Linux OS. The vulnerability resides in function sub_40F88C, which passes the ppp_custom argument from /tmp/ppp/wanoptions into a system call without sanitizing shell metacharacters. A public proof-of-concept exploit is available on Gitee, and because this project is abandoned - officially superseded by FreshTomato - no patch will be released, making affected deployments permanently vulnerable without firmware migration.
OS command injection in Shibby Tomato 1.28.0000 allows an authenticated remote administrator to execute arbitrary operating system commands via the `new_qoslimit_enable` argument passed to the `new_qoslimit_start` function in `/etc/qoslimit`. Exploitation requires high-privilege (admin-level) credentials, but a proof-of-concept is publicly available on Gitee. The project has been officially superseded by FreshTomato, meaning no vendor patch is expected and affected devices will remain permanently unpatched.
OS command injection in Shibby Tomato 1.28.0000's QoS management script allows an authenticated remote attacker with administrative access to execute arbitrary operating system commands on the affected router. The vulnerable function new_qoslimit_stop in /tmp/qoslimittc_stop.sh accepts a wan_iface argument that is passed unsanitized into a shell command, yielding full system-level code execution. A public proof-of-concept advisory has been disclosed on Gitee; no vendor patch is expected because Shibby Tomato is end-of-life, formally superseded by FreshTomato.
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.
Stack-based buffer overflow in Shibby Tomato router firmware (versions up to and including 1.28.0000) allows a remote, low-privileged attacker to corrupt the stack of the embedded web server (/usr/sbin/httpd) via the DNS List Rendering function sub_407220, potentially achieving arbitrary code execution on the router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low-level authentication (PR:L) to the web administration interface. VulDB assigns an exploit maturity of Proof-of-Concept, meaning publicly available exploit code exists, though it is not listed in CISA KEV and no active exploitation is confirmed. Notably, the Tomato project by Shibby is discontinued and superseded by FreshTomato, so no first-party fix is expected.
Out-of-bounds write in the Shibby Tomato router firmware (versions up to and including 1.28.0000) lets authenticated remote users corrupt memory through the apcupsd web component. The flaw sits in the main() function of www/apcupsd/tomatodata.cgi, where crafted input reaches an out-of-bounds write (CWE-787) that can crash the CGI or potentially execute code on the router. Publicly available exploit code exists (via VulDB/Gitee), but there is no confirmed active exploitation; note that this project has been superseded by FreshTomato and is effectively end-of-life.
Remote authenticated command execution is possible in Shibby Tomato router firmware through version 1.28.0000, where the getupsvar function in the apcupsd CGI handler (www/apcupsd/tomatodata.cgi) fails to bound the Field argument, producing a stack-based buffer overflow (CWE-121). A logged-in user can send a crafted request to corrupt the stack and hijack control flow with full confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (VulDB), though there is no evidence of active exploitation; the CVSS 4.0 score is 8.7 with an E:P (proof-of-concept) exploit-maturity flag.
OS command injection in Shibby Tomato 1.28.0000 firmware allows authenticated remote attackers to execute arbitrary operating system commands by manipulating input to the rstats_path function within the /bin/rstats binary exposed via the Web UI. Publicly available exploit code exists per the Gitee advisory disclosed through VulDB, and the affected project is end-of-life - superseded by FreshTomato - meaning no upstream vendor patch is forthcoming. CVSS 4.0 base score is 7.3 with high privileges required but high confidentiality, integrity, and availability impact on the router.
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_vpnserver function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - meaning no upstream patch is forthcoming. The CVSS 4.0 score of 7.3 reflects high impact on confidentiality, integrity, and availability, but high privileges are required to trigger the flaw.
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary shell commands by manipulating the ipv6_6rd_borderrelay argument processed by the start_6rd_tunnel function in /sbin/rc via the Web UI. Publicly available exploit code exists per VulDB disclosure, and the project is end-of-life - superseded by FreshTomato - meaning no upstream fix is expected.
OS command injection in Shibby Tomato 1.28.0000 router firmware allows authenticated remote attackers to execute arbitrary operating system commands via the start_dhcpc function in /sbin/rc, reachable through the Web UI. Publicly available exploit code exists per the VulDB advisory. The project has been discontinued and superseded by FreshTomato, meaning no upstream fix from the original maintainer is expected.
Stack-based buffer overflow in Shibby Tomato router firmware (versions up to 1.28) allows remote attackers to corrupt memory in the ripd daemon via the rip_zebra_read_ipv4 function in the Zserv Handler component. Publicly available exploit code exists, and the project is end-of-life - superseded by FreshTomato - so no vendor patch will be released. CVSS 4.0 score of 7.4 reflects network attack vector with low complexity but requires low-privilege access (PR:L) per the vector.
OS command injection in Shibby Tomato firmware up to 1.28.0000 allows authenticated remote attackers to execute arbitrary commands on the underlying router OS by manipulating the cifs1 or cifs2 arguments passed to the CIFS Mount Handler function sub_2D048. A publicly available proof-of-concept exploit exists on Gitee, lowering the barrier to exploitation. The risk is compounded by the fact that Shibby Tomato is an end-of-life project with no active maintenance, superseded by FreshTomato, meaning no patch is forthcoming from the original vendor.
OS command injection in Shibby Tomato router firmware through version 1.28.0000 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the jffs2_exec argument in the start_jffs2 component's sub_2D568 function. A publicly available proof-of-concept exploit exists on Gitee, confirming exploitability beyond theoretical analysis. The project is officially abandoned and superseded by FreshTomato, meaning no vendor patch will ever be released - remediation requires migrating to supported firmware.
The admin API in the tomato module before 0.0.6 for Node.js does not properly check the access key when it is set to a string, which allows remote attackers to bypass authentication via a string in. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available.