Is CVE-2026-15545 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15545 being exploited in the wild.

How severe is CVE-2026-15545?

High severity, with a CVSS score of 8.8, published 13 July 2026.

Which products and versions are affected?

Shibby Tomato Shibby Up to 1.28.0000.

Is there a fix for CVE-2026-15545?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15545 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-15545?

Check whether you run Shibby Tomato Shibby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15545: Shibby Tomato out-of-bounds write in apcupsd CGI programs

CVE-2026-15545 · Severity: high · CVSS 8.8 · Published 2026-07-13

Shibby Tomato is a third-party firmware used on various network routers to provide advanced features and management capabilities. A security vulnerability exists in the component responsible for monitoring Uninterruptible Power Supplies (UPS), where processing a specially crafted configuration file can cause the system to crash or allow for unauthorized code execution. While an attacker would typically need the ability to modify local configuration files, a successful exploit could lead to a complete takeover of the router or a persistent denial of service.

Technologies: Shibby Tomato Shibby. Vendors: Shibby.

Quick answers

Is CVE-2026-15545 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15545 being exploited in the wild.
How severe is CVE-2026-15545?: High severity, with a CVSS score of 8.8, published 13 July 2026.
Which products and versions are affected?: Shibby Tomato Shibby Up to 1.28.0000.
Is there a fix for CVE-2026-15545?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15545 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-15545?: Check whether you run Shibby Tomato Shibby at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) NUL byte write exists in the main() function of the apcupsd CGI programs (tomatodata.cgi, tomatoups.cgi, and multimon.cgi) within Shibby Tomato firmware. The vulnerability is triggered during the parsing of the '/usr/local/apcupsd/multimon.conf' configuration file. Specifically, the code uses fgets() to read up to 512 bytes into a 6-byte stack buffer (v27), followed by an incorrect index calculation 'v26[strlen(v27) + 4095] = 0'. Because v27 can be overflowed, strlen(v27) can return values up to 511, causing the NUL byte to be written up to 511 bytes beyond the intended 4096-byte buffer (v26). This corrupts adjacent stack data, including saved registers and return addresses, potentially allowing for control-flow hijacking. The Shibby Tomato project is superseded by FreshTomato, and users are encouraged to migrate.

Affected products

Shibby Tomato Up to 1.28.0000

Timeline

2026-06-10: disclosed: Initial report by Fengyi Wang via Gitee
2026-07-13: advisory: NVD/VulDB publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.