Is CVE-2026-15544 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15544 being exploited in the wild.

How severe is CVE-2026-15544?

High severity, with a CVSS score of 8.8, published 13 July 2026.

Which products and versions are affected?

Shibby Tomato by Shibby up to 1.28.0000.

Is there a fix for CVE-2026-15544?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15544 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-15544?

Check whether you run Shibby Tomato by Shibby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15544: Shibby Tomato stack overflow in apcupsd getupsvar

CVE-2026-15544 · Severity: high · CVSS 8.8 · Published 2026-07-13

A security vulnerability exists in the Shibby Tomato firmware, which is used in various network routers. The flaw is located in the component that monitors Uninterruptible Power Supplies (UPS). If exploited, a remote attacker could cause the router to crash or potentially take full control of the device, leading to a complete loss of network availability and potential data interception. This firmware project is no longer maintained and has been replaced by FreshTomato.

Technologies: Shibby Tomato by Shibby. Vendors: Shibby.

Quick answers

Is CVE-2026-15544 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15544 being exploited in the wild.
How severe is CVE-2026-15544?: High severity, with a CVSS score of 8.8, published 13 July 2026.
Which products and versions are affected?: Shibby Tomato by Shibby up to 1.28.0000.
Is there a fix for CVE-2026-15544?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15544 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-15544?: Check whether you run Shibby Tomato by Shibby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the getupsvar() function within the apcupsd CGI programs (tomatodata.cgi, tomatoups.cgi, and multimon.cgi) of Shibby Tomato firmware up to version 1.28.0000. The vulnerability is caused by the use of an unbounded sscanf() format specifier ("%s") when processing UPS status data received via TCP port 3551. While the function signature includes a buffer size parameter, it is ignored in the v11==1 code path, allowing overlong field values to overwrite 64-byte stack-allocated buffers. An attacker can exploit this by providing a malicious response from a fake or compromised apcupsd server, leading to a crash (SIGSEGV) or remote code execution by overwriting the program counter. The project is superseded by FreshTomato, and users are advised to migrate.

Affected products

Shibby Tomato by Shibby up to 1.28.0000

Timeline

2026-05-02: other: Vulnerability discovered via static analysis
2026-05-12: other: Dynamic verification and PoC development completed
2026-06-10: disclosed: Public issue report created
2026-07-13: advisory: CVE published by VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.