Executive brief
A vulnerability exists in the Shibby Tomato firmware, which is software used to power various home and small office routers. An attacker can send specially crafted network requests to the router's UPnP service to consume all available system memory. This can cause the router to become slow, unresponsive, or crash, disrupting internet connectivity for all connected users.
Technical details
A resource exhaustion vulnerability (CWE-400) exists in the 'miniupnpd' daemon (specifically version 1.8) within Shibby Tomato firmware 1.28. The vulnerability is located in the HTTP request buffering logic within 'usr/sbin/miniupnpd'. The daemon uses realloc() to extend a heap-backed buffer as it receives HTTP headers and POST bodies, but it fails to enforce a maximum request size limit. An unauthenticated attacker on the LAN can exploit this by sending incomplete HTTP headers or large 'Content-Length' headers followed by partial bodies, leading to continuous heap growth and eventual denial of service. While the project is superseded by FreshTomato, this legacy version remains vulnerable.
Affected products
- Shibby Tomato by Shibby 1.28
Timeline
- 2026-04-22: disclosed: Vulnerability reported by Fengyi Wang via Gitee issue.
- 2026-05-29: advisory: CVE-2026-10069 published.