CVE-2026-10066: Shibby Tomato Stack Buffer Overflow in UPS Service (RCE)

Technical summary

The vulnerability resides in the sub_9068 function within tomatoups.cgi, the UPS Service handler in Shibby Tomato. The flaw is a stack-based buffer overflow (CWE-119, CWE-121) triggered through improper input validation or bounds checking. An authenticated remote attacker can craft malicious requests to overflow the stack buffer, potentially overwriting return addresses or other critical stack data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network accessibility, low attack complexity, and requirement for valid credentials—but once authenticated, full system compromise (confidentiality, integrity, availability) is possible.

Business impact

Organizations running Shibby Tomato are exposed to authenticated remote code execution. If an internal attacker or compromised account gains access, they can pivot to full system compromise of the router or network appliance. Data exfiltration, malware persistence, network surveillance, and lateral movement become feasible. For businesses relying on older Shibby Tomato deployments, the absence of vendor support means no security patches will be released, creating indefinite exposure unless systems are decommissioned or migrated.

Affected systems

Shibby Tomato versions up to and including 1.28 are affected. Shibby Tomato is a third-party firmware build for consumer routers and network appliances; it is no longer maintained by its original developer. Systems still running this firmware and exposing the UPS Service interface remotely or to untrusted network segments are at risk. The project has been superseded by FreshTomato, which may or may not have the same vulnerability depending on its codebase trajectory.

Exploitability

Exploitation requires authentication; an attacker must possess or obtain valid credentials to access the UPS Service interface. The attack vector is network-based with low complexity once credentials are obtained. Given the end-of-life status of Shibby Tomato and general awareness of this flaw, the risk is elevated in environments where credential theft, insider threats, or lateral movement is plausible. However, the authentication requirement prevents unauthenticated remote exploitation from the internet.

Remediation

The primary remediation is to migrate away from unsupported Shibby Tomato firmware. Organizations should evaluate FreshTomato or other actively maintained firmware alternatives for their devices. If immediate migration is infeasible, network segmentation to restrict access to the UPS Service and router management interfaces is essential. Disable or limit remote access to administrative functions and implement strict access control lists (ACLs) to trusted internal networks only.

Patch guidance

No patches will be released for Shibby Tomato, as the project is no longer supported. Verify your current firmware version and compare it against version 1.28. If you are running 1.28 or earlier, you are affected. Review FreshTomato's advisory and release notes to determine whether it has addressed this same code path. If migrating to FreshTomato, follow the vendor's upgrade guidance carefully to avoid bricking devices. For devices that cannot be upgraded, document their use case and implement compensating network controls.

Detection guidance

Monitor for unusual requests to tomatoups.cgi, particularly those with abnormally long or malformed parameters that might trigger buffer overflows. Review access logs for the UPS Service interface; normal operation should involve minimal traffic from expected internal sources. Intrusion detection systems (IDS) tuned for stack-overflow patterns may detect exploit attempts. Additionally, monitor for unexpected process spawning or privilege escalation on affected devices following suspicious requests.

Why prioritize this

Despite the authentication requirement, this vulnerability warrants prompt attention because: (1) it enables remote code execution with full system compromise, (2) Shibby Tomato is unmaintained and no fixes will ever arrive, (3) many legacy deployments may persist in enterprise or small-business environments due to cost or inertia, and (4) internal attackers or compromised low-privilege accounts can easily escalate via this flaw. Organizations should prioritize identifying and decommissioning affected systems.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects full confidentiality, integrity, and availability impact accessible to an authenticated attacker over the network. While authentication prevents opportunistic internet-wide attacks, the flaw's presence in unmaintained, possibly long-forgotten devices creates persistent risk within networks. The high score appropriately captures that, once an attacker clears the authentication hurdle (via credential theft, insider access, or lateral movement), system compromise is virtually guaranteed.

Frequently asked questions