CVE-2026-16095 Overview
CVE-2026-16095 is an out-of-bounds write vulnerability in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124, a router firmware distribution. The flaw resides in the setup_conntrack function of /sbin/rc and is triggered through manipulation of the ct_tcp_timeout argument. Attackers can exploit the issue remotely to corrupt memory outside the intended buffer boundaries. The Shibby Tomato project has been superseded by FreshTomato and no longer receives active maintenance.
Critical Impact
Remote attackers with low privileges can trigger an out-of-bounds write in the setup_conntrack function, leading to memory corruption on affected router firmware.
Affected Products
- Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124
- /sbin/rc binary containing the setup_conntrack function
- Devices running the discontinued Shibby Tomato firmware branch
Discovery Timeline
- 2026-07-18 - CVE-2026-16095 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16095
Vulnerability Analysis
The vulnerability is classified under [CWE-119] as an improper restriction of operations within the bounds of a memory buffer. The setup_conntrack function in the /sbin/rc binary processes the ct_tcp_timeout argument without validating input length or content against the destination buffer size. When an attacker supplies a crafted value, the function writes data beyond the allocated buffer boundary.
Out-of-bounds writes on embedded MIPS platforms can corrupt adjacent memory structures, function pointers, or stack return addresses. The affected firmware runs as a privileged process, expanding the impact scope. Because Shibby Tomato has been superseded by FreshTomato, no upstream security response is expected for the affected build.
Root Cause
The root cause is missing bounds checking on the ct_tcp_timeout parameter within setup_conntrack. The function accepts attacker-influenced input and writes it into a fixed-size buffer without validating length. This design flaw allows adjacent memory regions to be overwritten with arbitrary content.
Attack Vector
The attack is executed over the network against an authenticated management interface. An attacker with low-level privileges submits a manipulated ct_tcp_timeout value through the configuration path that reaches /sbin/rc. Successful exploitation corrupts memory, potentially resulting in denial of service or code execution on the router. No public proof-of-concept exploit code is currently available for this issue. See the VulDB CVE Report and Gitee CVE Issue Discussion for additional technical context.
Detection Methods for CVE-2026-16095
Indicators of Compromise
- Unexpected restarts or crashes of the /sbin/rc process on affected Tomato routers
- Configuration changes to ct_tcp_timeout originating from unauthorized management sessions
- Abnormal outbound connections from the router following administrative interface access
Detection Strategies
- Monitor router administrative logs for anomalous parameter values passed to conntrack configuration routines
- Inspect network traffic to router management interfaces for oversized or malformed configuration payloads
- Correlate authentication events with subsequent configuration writes touching ct_tcp_timeout
Monitoring Recommendations
- Forward router syslog and administrative event data to a centralized SIEM for long-term retention and correlation
- Alert on repeated authentication attempts followed by configuration parameter changes
- Track process stability metrics on the router to identify crash patterns consistent with memory corruption
How to Mitigate CVE-2026-16095
Immediate Actions Required
- Migrate affected devices from Shibby Tomato to the actively maintained FreshTomato firmware distribution
- Restrict access to the router administrative interface to trusted management networks only
- Rotate administrative credentials and enforce strong authentication on affected devices
- Audit historical configuration changes touching ct_tcp_timeout for signs of exploitation attempts
Patch Information
No vendor patch has been released for Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. The project is superseded by FreshTomato, which is the recommended migration target for continued security maintenance. Refer to the VulDB Vulnerability Report for updates on remediation guidance.
Workarounds
- Disable remote administrative access on the router and restrict management to LAN-side interfaces
- Place a network access control list in front of the router management ports to limit source addresses
- Segment routers running end-of-life firmware onto isolated management VLANs pending replacement
# Configuration example: restrict router admin interface access
# Applied on an upstream firewall protecting the management network
iptables -A FORWARD -p tcp --dport 80 -s <trusted_mgmt_cidr> -d <router_ip> -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -s <trusted_mgmt_cidr> -d <router_ip> -j ACCEPT
iptables -A FORWARD -p tcp --dport 80 -d <router_ip> -j DROP
iptables -A FORWARD -p tcp --dport 443 -d <router_ip> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
