Executive brief
A security vulnerability exists in the Shibby Tomato firmware, which is used in various network routers. The flaw is located in the component that monitors Uninterruptible Power Supplies (UPS). If exploited, a remote attacker could cause the router to crash or potentially take full control of the device, leading to a complete loss of network availability and potential data interception. This firmware project is no longer maintained and has been replaced by FreshTomato.
Technical details
A stack-based buffer overflow exists in the getupsvar() function within the apcupsd CGI programs (tomatodata.cgi, tomatoups.cgi, and multimon.cgi) of Shibby Tomato firmware up to version 1.28.0000. The vulnerability is caused by the use of an unbounded sscanf() format specifier ("%s") when processing UPS status data received via TCP port 3551. While the function signature includes a buffer size parameter, it is ignored in the v11==1 code path, allowing overlong field values to overwrite 64-byte stack-allocated buffers. An attacker can exploit this by providing a malicious response from a fake or compromised apcupsd server, leading to a crash (SIGSEGV) or remote code execution by overwriting the program counter. The project is superseded by FreshTomato, and users are advised to migrate.
Affected products
- Shibby Tomato by Shibby up to 1.28.0000
Timeline
- 2026-05-02: other: Vulnerability discovered via static analysis
- 2026-05-12: other: Dynamic verification and PoC development completed
- 2026-06-10: disclosed: Public issue report created
- 2026-07-13: advisory: CVE published by VulDB/NVD