CVE-2026-16097: Shibby Tomato Buffer Overflow Vulnerability

CVE-2026-16097 Overview

CVE-2026-16097 is a stack-based buffer overflow vulnerability in Shibby Tomato 1.28, a custom firmware distribution for consumer and small-business routers. The flaw resides in the sub_42537C function within the Scheduler Name Handler component. An attacker can manipulate the a1 argument to overflow a fixed-size stack buffer. The attack can be launched remotely over the network and requires only low-level authenticated privileges. The Shibby Tomato project is no longer maintained and has been superseded by FreshTomato, meaning affected devices will not receive official patches.

Critical Impact
Remote attackers with low-privilege credentials can trigger a stack buffer overflow in the Scheduler Name Handler, potentially achieving arbitrary code execution on affected router firmware [CWE-119].

Affected Products

Shibby Tomato firmware version 1.28
Router devices running Shibby Tomato 1.28 with the Scheduler feature enabled
Legacy deployments not migrated to FreshTomato

Discovery Timeline

2026-07-18 - CVE-2026-16097 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-16097

Vulnerability Analysis

The vulnerability exists in the sub_42537C function, part of the Scheduler Name Handler in Shibby Tomato 1.28. The function processes user-supplied scheduler name input without validating its length against the destination stack buffer. When an attacker supplies an oversized value to the a1 argument, the copy operation writes past the buffer boundary, corrupting adjacent stack memory. This corruption includes saved return addresses and stack frame pointers, which are typical targets for control-flow hijacking.

Because the affected component is exposed through the router's management interface, exploitation can occur remotely. The Common Weakness Enumeration classifies this issue as [CWE-119], improper restriction of operations within the bounds of a memory buffer. Successful exploitation impacts confidentiality, integrity, and availability of the router.

Root Cause

The root cause is the absence of bounds checking when handling the scheduler name argument in sub_42537C. The function uses an unsafe copy routine that trusts input length. No length validation, canary protection, or safe string function is applied before the write operation completes.

Attack Vector

An attacker with valid low-privilege credentials sends a crafted request to the router's scheduler configuration endpoint. The malicious payload contains an overlong scheduler name that overflows the fixed stack buffer in sub_42537C. Since Tomato firmware historically ships without modern exploit mitigations such as ASLR or stack canaries, the overflow can be leveraged to overwrite the saved return address and redirect execution. The vulnerability manifests through the router's web management interface exposed on the LAN or, in misconfigured deployments, the WAN.

Technical details are tracked in the Gitee CVE Discussion Issue and VulDB Vulnerability #379801.

Detection Methods for CVE-2026-16097

Indicators of Compromise

Unexpected reboots, crashes, or watchdog resets on routers running Shibby Tomato 1.28
HTTP POST requests to scheduler configuration endpoints containing abnormally long name parameters
Anomalous outbound connections from the router management plane to unknown hosts
Unauthorized modifications to scheduler entries in the router configuration

Detection Strategies

Inspect web management logs for scheduler-related requests containing names longer than expected field limits
Monitor router syslog output for segmentation faults or process crashes tied to the httpd or scheduler daemon
Deploy network intrusion detection signatures that flag oversized parameter values submitted to router administration endpoints

Monitoring Recommendations

Forward router syslog and authentication logs to a centralized SIEM for correlation and retention
Alert on repeated failed or successful low-privilege logins to router management interfaces from unusual source addresses
Track configuration drift on router scheduler settings to identify unauthorized changes

How to Mitigate CVE-2026-16097

Immediate Actions Required

Migrate affected devices from Shibby Tomato 1.28 to the actively maintained FreshTomato firmware, which supersedes this project
Restrict router management interfaces to trusted management VLANs only and block WAN-side access
Rotate all router administrator and low-privilege user credentials to reduce the risk of authenticated exploitation
Audit existing scheduler configuration entries for unexpected additions or modifications

Patch Information

No official patch is available. Shibby Tomato is no longer maintained. Users must migrate to FreshTomato or an alternative supported router firmware. Verify hardware compatibility with the replacement firmware before flashing.

Workarounds

Disable the scheduler feature in the router configuration if it is not required
Enforce firewall rules that permit management access only from a dedicated administrative host
Place legacy Tomato routers behind a network segment isolated from untrusted users and IoT devices
Replace end-of-life router hardware that cannot run supported firmware

bash

# Example iptables rules restricting management access to a single admin host
iptables -I INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -j DROP
iptables -I INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j DROP