Executive brief
Shibby Tomato is a third-party firmware used on various network routers to provide advanced features and management capabilities. A security vulnerability exists in the component responsible for monitoring Uninterruptible Power Supplies (UPS), where processing a specially crafted configuration file can cause the system to crash or allow for unauthorized code execution. While an attacker would typically need the ability to modify local configuration files, a successful exploit could lead to a complete takeover of the router or a persistent denial of service.
Technical details
An out-of-bounds (OOB) NUL byte write exists in the main() function of the apcupsd CGI programs (tomatodata.cgi, tomatoups.cgi, and multimon.cgi) within Shibby Tomato firmware. The vulnerability is triggered during the parsing of the '/usr/local/apcupsd/multimon.conf' configuration file. Specifically, the code uses fgets() to read up to 512 bytes into a 6-byte stack buffer (v27), followed by an incorrect index calculation 'v26[strlen(v27) + 4095] = 0'. Because v27 can be overflowed, strlen(v27) can return values up to 511, causing the NUL byte to be written up to 511 bytes beyond the intended 4096-byte buffer (v26). This corrupts adjacent stack data, including saved registers and return addresses, potentially allowing for control-flow hijacking. The Shibby Tomato project is superseded by FreshTomato, and users are encouraged to migrate.
Affected products
- Shibby Tomato Up to 1.28.0000
Timeline
- 2026-06-10: disclosed: Initial report by Fengyi Wang via Gitee
- 2026-07-13: advisory: NVD/VulDB publication