CVE-2026-15545: Shibby Tomato Buffer Overflow Vulnerability

CVE-2026-15545 Overview

CVE-2026-15545 is an out-of-bounds write vulnerability in Shibby Tomato firmware versions up to 1.28.0000. The flaw resides in the main function of www/apcupsd/tomatodata.cgi, part of the apcupsd component that exposes UPS status through the router web interface. Attackers can trigger the condition remotely over the network with low privileges. Public exploit details are available through VulDB and a Gitee issue tracker. The Shibby fork of Tomato is superseded by FreshTomato, meaning affected devices likely remain unpatched. The weakness is classified under [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers with low-privilege access to the Tomato router web interface can write outside allocated memory buffers, potentially achieving code execution on the device.

Affected Products

Shibby Tomato firmware versions up to and including 1.28.0000
The apcupsd component, specifically www/apcupsd/tomatodata.cgi
Legacy Tomato-based router deployments (project superseded by FreshTomato)

Discovery Timeline

2026-07-13 - CVE-2026-15545 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15545

Vulnerability Analysis

The vulnerability exists in the main function of the CGI binary tomatodata.cgi located under www/apcupsd/. This CGI script is invoked by the Tomato router web UI to render data reported by apcupsd, the daemon that manages APC-branded uninterruptible power supplies. Improper bounds checking during input handling allows an authenticated remote attacker to write memory outside the allocated buffer. The attack traverses the network and requires only low-privilege access, which on many home routers corresponds to a standard authenticated user session.

Root Cause

The root cause is missing or insufficient boundary validation on data processed by tomatodata.cgi before it is copied into a fixed-size buffer. [CWE-119] describes this class of memory safety defect where the program performs operations on a buffer without confirming the destination has enough space. Because CGI binaries in Tomato firmware run with elevated privileges under the embedded HTTP server, corrupting adjacent memory can influence control flow within the process.

Attack Vector

Exploitation requires network reachability to the router web interface and valid low-privilege credentials. An attacker issues a crafted HTTP request to the apcupsd/tomatodata.cgi endpoint containing payload data that exceeds expected size constraints. When the main function processes the request, the out-of-bounds write overwrites adjacent memory. Because the exploit is publicly documented, opportunistic actors can weaponize it against exposed devices. Refer to the Gitee Issue Discussion and VulDB Vulnerability Details for the technical write-up.

Detection Methods for CVE-2026-15545

Indicators of Compromise

HTTP requests targeting /apcupsd/tomatodata.cgi with abnormally long parameter values or malformed query strings.
Unexpected crashes, restarts, or watchdog events on the embedded HTTP server process (httpd) on Tomato routers.
New or unfamiliar processes spawned by the router web server following requests to the apcupsd CGI path.

Detection Strategies

Inspect router access logs and any upstream reverse proxy or firewall logs for requests to tomatodata.cgi originating from unexpected source addresses.
Deploy network intrusion detection signatures that flag oversized parameters delivered to /apcupsd/* CGI endpoints.
Correlate authentication events with subsequent CGI activity to identify sessions that immediately probe the apcupsd interface.

Monitoring Recommendations

Continuously monitor administrative interfaces of Tomato-based routers for exposure to untrusted networks such as the public internet.
Alert on any HTTP request whose URI contains apcupsd/tomatodata.cgi combined with non-standard user agents.
Track firmware version banners and identify hosts still running Shibby Tomato builds at or below 1.28.0000.

How to Mitigate CVE-2026-15545

Immediate Actions Required

Restrict access to the router administrative interface to trusted management VLANs and known administrator IP ranges.
Rotate router administrator credentials and remove any unnecessary low-privilege accounts that could be used to reach the CGI endpoint.
Disable the apcupsd feature in the router configuration if UPS monitoring is not required.

Patch Information

Shibby Tomato is no longer maintained. The project is superseded by FreshTomato, and no vendor patch is expected for the affected 1.28.0000 and earlier builds. Administrators should migrate to a current, actively maintained firmware such as FreshTomato and verify that the apcupsd CGI in the replacement firmware is not affected. Additional context is available at the VulDB CVE Entry.

Workarounds

Block external access to TCP ports used by the router web UI at the perimeter firewall.
Remove or rename www/apcupsd/tomatodata.cgi on affected devices where UPS monitoring is not in use.
Place management interfaces behind a VPN so authentication to the CGI endpoint is not reachable from untrusted networks.

bash

# Example iptables rule restricting router web UI access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP