# CVE-2026-10124: Shibby Tomato stack-based buffer overflow in ripd Zserv Handler

Source: https://junglewise.ai/threats/cve-2026-10124-shibby-tomato-stack-based-buffer-overflow-in-ripd-zserv-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-30. Updated: 2026-05-30  
License: CC BY 4.0 with a link back

CVE-2026-10124 · Severity: high · CVSS 8.8 · Published 2026-05-30

Shibby Tomato is a legacy third-party firmware for home and small-office routers. A vulnerability in its routing daemon (ripd) allows a local attacker or a compromised system service to crash the routing process or potentially execute unauthorized code. This could lead to a complete loss of router stability and control, though the project is no longer supported and users are encouraged to migrate to FreshTomato.

Technologies: [Shibby Tomato by Shibby](https://junglewise.ai/threats/technologies/tomato-by-shibby). Vendors: [Shibby](https://junglewise.ai/threats/vendors/shibby).

## Quick answers

**Is CVE-2026-10124 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10124 being exploited in the wild.

**How severe is CVE-2026-10124?** High severity, with a CVSS score of 8.8, published 30 May 2026.

**Which products and versions are affected?** Shibby Tomato by Shibby up to 1.28.0005 124 ND USB.

**Is there a fix for CVE-2026-10124?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10124 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-10124?** Check whether you run Shibby Tomato by Shibby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the 'rip_zebra_read_ipv4' function within the 'ripd' binary of Shibby Tomato firmware. The vulnerability is caused by a failure to validate the IPv4 prefix length (plen) received over the local Unix domain socket '/tmp/.zserv'. An attacker can provide a prefix length greater than 32, causing the daemon to calculate an excessively large byte count for a stack-based copy operation. This results in an out-of-bounds write that can overwrite saved registers and the return address. While the NVD entry suggests remote reachability, technical analysis indicates the primary vector is local IPC, though it may be reachable indirectly via authenticated administrative interfaces. The product is end-of-life and superseded by FreshTomato.

## Affected products

- Shibby Tomato by Shibby up to 1.28.0005 124 ND USB

## Timeline

- 2026-04-19: disclosed: Initial disclosure on Gitee by researcher Fengyi Wang
- 2026-05-30: advisory: CVE published and NVD record created

## References

- [https://gitee.com/Fengyi-Wang/CVE/issues/IJ9FFG](https://gitee.com/Fengyi-Wang/CVE/issues/IJ9FFG)
- [https://vuldb.com/submit/818239](https://vuldb.com/submit/818239)
- [https://vuldb.com/vuln/367301](https://vuldb.com/vuln/367301)
- [https://vuldb.com/vuln/367301/cti](https://vuldb.com/vuln/367301/cti)

## Related threats

- [Shibby Tomato stack overflow in apcupsd getupsvar](https://junglewise.ai/threats/cve-2026-15544-shibby-tomato-stack-overflow-in-apcupsd-getupsvar)
- [Shibby Tomato miniupnpd Information Disclosure in SUBSCRIBE Call Handler](https://junglewise.ai/threats/cve-2026-10068-shibby-tomato-miniupnpd-information-disclosure-in-subscribe-call)
- [Shibby Tomato stack buffer overflow in tomatoups.cgi UPS Service](https://junglewise.ai/threats/cve-2026-10066-shibby-tomato-stack-buffer-overflow-in-tomatoups-cgi-ups-service)
- [Shibby Tomato stack buffer overflow in tomatodata.cgi](https://junglewise.ai/threats/cve-2026-10065-shibby-tomato-stack-buffer-overflow-in-tomatodata-cgi)