CVE-2026-10124: Shibby Tomato Buffer Overflow Vulnerability

CVE-2026-10124 Overview

CVE-2026-10124 is a stack-based buffer overflow [CWE-119] in Shibby Tomato firmware versions up to 1.28. The flaw resides in the rip_zebra_read_ipv4 function within /usr/sbin/ripd, a component of the Zserv Handler used by the Routing Information Protocol (RIP) daemon. Remote attackers can trigger the overflow by sending crafted input to the affected component. The exploit details have been publicly disclosed. Shibby Tomato is no longer maintained and has been superseded by FreshTomato, so no official patch will be released for affected versions.

Critical Impact
Remote attackers with low-privilege network access can trigger memory corruption in the RIP daemon, potentially leading to arbitrary code execution on the router.

Affected Products

Shibby Tomato firmware versions up to and including 1.28
ripd routing daemon binary located at /usr/sbin/ripd
Zserv Handler component responsible for IPv4 route processing

Discovery Timeline

2026-05-30 - CVE-2026-10124 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10124

Vulnerability Analysis

The vulnerability exists in the rip_zebra_read_ipv4 function of the ripd binary shipped with Shibby Tomato. This function handles IPv4 route advertisements received through the Zserv protocol, which mediates communication between the routing daemon and the zebra routing manager. Improper bounds checking on incoming data allows attacker-controlled input to exceed the fixed-size stack buffer allocated to hold the message contents.

When the overflow occurs, adjacent stack memory becomes corruptible, including saved return addresses and frame pointers. An attacker with the ability to interact with the Zserv interface can leverage this corruption to redirect execution flow. Because ripd typically runs with elevated privileges on embedded router firmware, successful exploitation grants control over routing decisions and the underlying device.

Root Cause

The root cause is missing or insufficient length validation on data read from the Zserv socket inside rip_zebra_read_ipv4. The function copies route message payload into a stack-allocated buffer without enforcing a maximum size that matches the buffer's capacity. This is a classic [CWE-119] improper restriction of operations within the bounds of a memory buffer.

Attack Vector

The attack vector is network-based and requires only low privileges. An attacker who can reach the Zserv handler interface on the affected device sends a crafted IPv4 route advertisement designed to exceed the buffer boundary. No user interaction is required. Because the project is unmaintained and the exploit has been publicly disclosed, opportunistic exploitation against exposed legacy Tomato routers is feasible.

No verified proof-of-concept code is published with the CVE record. Refer to the Gitee CVE Issue Discussion and VulDB Vulnerability Details for technical specifics.

Detection Methods for CVE-2026-10124

Indicators of Compromise

Unexpected crashes, restarts, or core dumps of the ripd process on Shibby Tomato devices
Anomalous RIP or Zserv protocol traffic containing oversized IPv4 route entries
New or unexplained routing table modifications consistent with attacker-injected routes
Outbound connections from the router to unfamiliar IP addresses following routing protocol traffic

Detection Strategies

Inspect inbound traffic for malformed RIP/Zserv packets with route payload lengths exceeding protocol-defined limits
Monitor router system logs for repeated ripd daemon failures or unexpected privilege transitions
Apply network intrusion detection signatures focused on RIPv1/RIPv2 protocol anomalies on UDP port 520

Monitoring Recommendations

Centralize router syslog output to a SIEM and alert on ripd segmentation faults or restarts
Baseline normal RIP advertisement sizes and flag deviations indicative of overflow attempts
Track changes to the routing table and correlate with adjacent network protocol events

How to Mitigate CVE-2026-10124

Immediate Actions Required

Migrate affected devices from Shibby Tomato to FreshTomato or another actively maintained firmware that addresses this class of issue
Restrict access to the RIP daemon and Zserv interface to trusted management segments only
Disable the RIP routing protocol on devices that do not require dynamic routing

Patch Information

Shibby Tomato is no longer supported by its maintainer and will not receive a vendor patch for CVE-2026-10124. The project has been superseded by FreshTomato. Operators must replace affected firmware with a supported alternative to fully remediate the vulnerability.

Workarounds

Block UDP port 520 and other RIP-related traffic at the network perimeter and on untrusted interfaces
Place affected routers behind a firewall that filters unsolicited routing protocol traffic
Segment management and routing protocol traffic from user networks using VLANs and access control lists
Decommission internet-exposed Shibby Tomato devices that cannot be migrated to maintained firmware

bash

# Example: disable RIP and block port 520 on iptables-capable Linux gateway
iptables -A INPUT -p udp --dport 520 -j DROP
iptables -A INPUT -p udp --sport 520 -j DROP
# Verify ripd is not running
pidof ripd && killall ripd