Executive brief
A memory safety vulnerability exists in the Shibby Tomato firmware, which is used in various home and small office routers. The flaw occurs when the system processes network connection tracking settings, potentially allowing an attacker to cause a system crash or gain unauthorized control over the device. This could lead to a complete loss of internet connectivity or the compromise of data passing through the router.
Technical details
A stack-based out-of-bounds write vulnerability exists in the setup_conntrack function (located at 0x41F708) within the /sbin/rc binary of Shibby Tomato firmware. The root cause is the use of an unchecked sprintf call that formats ten unsigned integers into a fixed 72-byte stack buffer. If the source values (read from procfs or NVRAM) are sufficiently large, the resulting string can reach approximately 92 bytes, overflowing the buffer by 20 bytes. This overflow can corrupt adjacent saved registers on the stack. While the primary impact is service instability or denial-of-service during boot or firewall configuration, it may potentially be leveraged for remote code execution by an authenticated user. The Shibby Tomato project is superseded by FreshTomato.
Affected products
- Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 1.28 RT-N5x MIPSR2 Build 124
Timeline
- 2026-06-10: disclosed: Initial researcher report on Gitee
- 2026-07-18: advisory: CVE published in NVD dataset