CVE-2026-10067: Shibby Tomato Buffer Overflow Vulnerability

CVE-2026-10067 Overview

CVE-2026-10067 is a stack-based buffer overflow vulnerability in Shibby Tomato 1.28, an open-source router firmware distribution. The flaw resides in the sub_90F0 function within the multimon.cgi binary. Remote attackers with low privileges can manipulate input to corrupt the stack, leading to memory corruption and potential code execution on affected devices. Shibby Tomato is no longer maintained and has been superseded by FreshTomato, meaning no official patch will be issued. The vulnerability is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote attackers can trigger a stack-based buffer overflow in multimon.cgi, compromising confidentiality, integrity, and availability of affected Shibby Tomato 1.28 routers.

Affected Products

Shibby Tomato 1.28 (end-of-life, superseded by FreshTomato)
The vulnerable component is the sub_90F0 function in multimon.cgi
No supported versions remain — the project is no longer maintained

Discovery Timeline

2026-05-29 - CVE-2026-10067 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-10067

Vulnerability Analysis

The vulnerability resides in the sub_90F0 function of the multimon.cgi binary in Shibby Tomato 1.28. multimon.cgi serves as a CGI handler within the router's web management interface, exposing administrative monitoring functionality over HTTP. The function fails to enforce bounds checking when processing attacker-controlled input, allowing a stack buffer to be written past its allocated size. This corruption overwrites adjacent stack frame data, including saved return addresses, which can redirect program execution flow. Because the affected component runs as part of the router's privileged web service, successful exploitation impacts confidentiality, integrity, and availability of the device. The attack requires only low-privileged authentication and can be launched remotely over the network.

Root Cause

The root cause is improper bounds validation [CWE-119] in sub_90F0. The function copies user-supplied data into a fixed-size stack buffer without verifying input length. Because Tomato firmware historically targets embedded MIPS and ARM platforms with limited exploit mitigations, stack canaries and address space layout randomization (ASLR) may be absent or weak, increasing the practicality of exploitation.

Attack Vector

An authenticated remote attacker sends a crafted HTTP request to the multimon.cgi endpoint exposed by the router's web interface. The oversized parameter reaches sub_90F0, overflows the stack buffer, and overwrites control data. If the management interface is exposed to the WAN, the attack surface extends to internet-based adversaries. Verified exploit code is not publicly available at the time of publication. For technical context, see the Gitee CVE Issue Discussion and the VulDB Vulnerability #367153 record.

Detection Methods for CVE-2026-10067

Indicators of Compromise

Unexpected HTTP POST or GET requests to /multimon.cgi containing oversized parameters or non-printable byte sequences
Router crashes, unexpected reboots, or httpd process restarts following inbound web requests
New or unfamiliar processes spawned by the router's web service
Outbound connections from the router to unknown hosts following web-interface activity

Detection Strategies

Inspect router HTTP access logs for requests to multimon.cgi with abnormally long query strings or POST bodies
Apply network intrusion detection signatures that flag CGI requests exceeding expected parameter length thresholds
Monitor for repeated authentication attempts against the router web interface, which often precede exploitation

Monitoring Recommendations

Forward router syslog and web server logs to a centralized logging platform for retention and correlation
Alert on any external (WAN-side) access to the Tomato administrative interface
Baseline normal multimon.cgi request patterns and alert on statistical deviations in request size or frequency

How to Mitigate CVE-2026-10067

Immediate Actions Required

Disable remote (WAN) administration on Shibby Tomato 1.28 devices and restrict the web interface to trusted LAN segments
Migrate affected devices to FreshTomato, which supersedes the unmaintained Shibby Tomato project
Rotate administrative credentials, since the attack requires low-privileged authentication
Inventory all routers running Shibby Tomato firmware and prioritize replacement or reflashing

Patch Information

No official patch is available. Shibby Tomato is no longer supported by its maintainer, and the project has been replaced by FreshTomato. Users must migrate to an actively maintained firmware distribution. See the VulDB Submission #818146 for the original disclosure record.

Workarounds

Place affected routers behind an upstream firewall and block inbound access to the web management port
Enforce strong, unique administrator passwords to raise the bar against credential-based access
Disable the multimon.cgi functionality if the firmware build permits, or restrict CGI access via access control lists
Replace end-of-life hardware with devices supported by maintained firmware projects

bash

# Configuration example: restrict router web interface to LAN only
# (Applied via Tomato's iptables firewall script)
iptables -I INPUT -i $(nvram get wan_iface) -p tcp --dport 80 -j DROP
iptables -I INPUT -i $(nvram get wan_iface) -p tcp --dport 443 -j DROP