CVE-2026-10066: Shibby Tomato Buffer Overflow Vulnerability

CVE-2026-10066 Overview

CVE-2026-10066 is a stack-based buffer overflow vulnerability in Shibby Tomato firmware versions up to 1.28. The flaw resides in the sub_9068 function within the tomatoups.cgi binary, part of the UPS Service component. Attackers can trigger the overflow remotely with low-privilege authentication, potentially achieving arbitrary code execution on the affected router firmware. The Shibby Tomato project is no longer maintained and has been superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer, meaning no official patch will be released.

Critical Impact
Remote attackers with low-privileged access can corrupt the stack of tomatoups.cgi, leading to potential arbitrary code execution on devices running end-of-life Shibby Tomato firmware.

Affected Products

Shibby Tomato firmware versions up to and including 1.28
tomatoups.cgi component (UPS Service)
Devices running unsupported Shibby Tomato builds (project superseded by FreshTomato)

Discovery Timeline

2026-05-29 - CVE-2026-10066 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-10066

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer. The flaw exists in the sub_9068 function of tomatoups.cgi, which handles UPS (Uninterruptible Power Supply) service requests in the Shibby Tomato router firmware. Attacker-controlled input reaches a fixed-size stack buffer without proper length validation, allowing adjacent stack memory, including saved return addresses, to be overwritten.

The attack vector is network-based and can be initiated remotely with low privileges. Successful exploitation can compromise confidentiality, integrity, and availability of the affected device. Because the project is end-of-life, no vendor patch is forthcoming. The EPSS score is 0.046% with a percentile of 14.59, indicating low observed exploitation probability at present.

Root Cause

The root cause is unbounded copying of attacker-supplied data into a fixed-size stack buffer inside sub_9068. The function lacks bounds checking on input length before writing to the local buffer, which allows the saved frame pointer and return address to be overwritten when input exceeds the buffer size.

Attack Vector

An authenticated remote attacker sends a crafted HTTP request to the tomatoups.cgi endpoint exposed by the router's management interface. The oversized payload reaches sub_9068 and overflows the stack buffer. Depending on stack protections compiled into the binary, the attacker may redirect execution flow to attacker-controlled memory or trigger a denial-of-service condition.

No verified public proof-of-concept code is available for this issue. Technical details are referenced in the Gitee Issue Report and the VulDB Vulnerability Detail.

Detection Methods for CVE-2026-10066

Indicators of Compromise

Unexpected crashes or restarts of the tomatoups.cgi process recorded in router system logs
Oversized or malformed HTTP POST requests targeting tomatoups.cgi URIs in web server access logs
Unauthorized configuration changes or new administrative sessions originating from external IP addresses
Outbound connections from the router to unfamiliar hosts following UPS service requests

Detection Strategies

Inspect HTTP traffic to router management interfaces for abnormally long parameter values directed at tomatoups.cgi
Monitor for repeated requests to UPS-related CGI endpoints from a single source within a short window
Correlate router crash logs with preceding HTTP requests to identify exploitation attempts

Monitoring Recommendations

Forward router syslog data to a centralized log management or SIEM platform for retention and analysis
Enable network-level intrusion detection signatures for buffer overflow patterns against embedded web interfaces
Track administrative authentication events on affected routers and alert on anomalies

How to Mitigate CVE-2026-10066

Immediate Actions Required

Disable remote administration on affected routers and restrict the management interface to trusted internal networks only
Disable the UPS service on Shibby Tomato devices if it is not actively used
Place affected routers behind a network segmentation boundary that blocks untrusted access to CGI endpoints
Rotate administrative credentials to limit the value of any compromised low-privilege accounts

Patch Information

No official patch is available. The Shibby Tomato project is end-of-life and has been superseded by FreshTomato. Affected users should migrate to a maintained firmware such as FreshTomato or replace the device with hardware that receives current security updates.

Workarounds

Migrate to FreshTomato or another actively maintained router firmware that does not contain the vulnerable sub_9068 code path
Block external access to the router web management interface using upstream firewall rules
Restrict access to tomatoups.cgi via local web server access control lists where the firmware allows
Decommission unsupported devices that cannot be migrated to maintained firmware

bash

# Example iptables rules restricting management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP