CVE-2026-15548
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
A security vulnerability was found in Shibby Tomato up to version 1.28.0000 in the sub_407220 function of the /usr/sbin/httpd file within the DNS List Rendering component. Manipulation leads to a stack-based buffer overflow, which can be exploited remotely. This project is superseded by FreshTomato.
Risk Assessment
An attacker can remotely cause a service crash or potentially execute arbitrary code, threatening system availability and integrity.
Recommendation
Immediately migrate to FreshTomato, as Shibby Tomato is no longer supported and will not receive security patches.
Other vulnerabilities in Shibby Tomato
See all- CVE-2026-19036High
A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.
- CVE-2026-19035High
A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.
- CVE-2026-19034High
A vulnerability was found in Shibby Tomato 1.28.0000 in the function new_qoslimit_stop of /tmp/qoslimittc_stop.sh. Manipulating the wan_iface argument leads to OS command injection. The attack can be launched remotely.
- CVE-2026-16097High
A stack-based buffer overflow vulnerability was found in Shibby Tomato 1.28 in the sub_42537C function of the Scheduler Name Handler component. Manipulation of the a1 argument allows remote exploitation. This project is superseded by FreshTomato.
- CVE-2026-16096High
In Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124, a stack-based buffer overflow vulnerability exists in the sub_40BB50 function of the /proc/webmon_recent_domains file. The attack can be performed remotely. This project is superseded by FreshTomato.
- CVE-2026-16095High
A flaw in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 in the setup_conntrack function of /sbin/rc allows out-of-bounds write via the ct_tcp_timeout argument. The attack can be performed remotely.
- CVE-2026-15547Medium
A vulnerability in Shibby Tomato up to version 1.28.0000 allows OS command injection via the CIFS Mount Handler component's sub_2D048 function. Manipulating the cifs1/cifs2 argument enables remote command execution. The exploit is publicly available, increasing attack risk.
- CVE-2026-15546Medium
A security flaw in Shibby Tomato up to 1.28.0000 affects the sub_2D568 function of the start_jffs2 component. Manipulating the jffs2_exec argument leads to OS command injection. Remote exploitation is possible and the exploit has been publicly released.
- CVE-2026-15544High
In Shibby Tomato up to version 1.28.0000, the apcupsd component's getupsvar function in www/apcupsd/tomatodata.cgi is vulnerable to a stack-based buffer overflow via the Field argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-10873High
A vulnerability in Shibby Tomato 1.28.0000 in the rstats_path function allows remote OS command injection. Exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.