Executive brief
Shibby Tomato is a legacy third-party firmware for home and small-office routers. A vulnerability in its routing daemon (ripd) allows a local attacker or a compromised system service to crash the routing process or potentially execute unauthorized code. This could lead to a complete loss of router stability and control, though the project is no longer supported and users are encouraged to migrate to FreshTomato.
Technical details
A stack-based buffer overflow exists in the 'rip_zebra_read_ipv4' function within the 'ripd' binary of Shibby Tomato firmware. The vulnerability is caused by a failure to validate the IPv4 prefix length (plen) received over the local Unix domain socket '/tmp/.zserv'. An attacker can provide a prefix length greater than 32, causing the daemon to calculate an excessively large byte count for a stack-based copy operation. This results in an out-of-bounds write that can overwrite saved registers and the return address. While the NVD entry suggests remote reachability, technical analysis indicates the primary vector is local IPC, though it may be reachable indirectly via authenticated administrative interfaces. The product is end-of-life and superseded by FreshTomato.
Affected products
- Shibby Tomato by Shibby up to 1.28.0005 124 ND USB
Timeline
- 2026-04-19: disclosed: Initial disclosure on Gitee by researcher Fengyi Wang
- 2026-05-30: advisory: CVE published and NVD record created