Executive brief
A vulnerability exists in the Shibby Tomato firmware, which is used in various network routers. The flaw occurs when the router's web interface processes web monitoring logs, allowing a specially crafted log entry to crash the management service or potentially allow unauthorized actions. This could lead to a loss of router stability or compromise of the device's management functions. Users are advised that this project is legacy and has been superseded by FreshTomato.
Technical details
A stack-based buffer overflow exists in the 'httpd' component of Shibby Tomato firmware, specifically within the 'sub_40BB50' function. The vulnerability is caused by the use of 'sscanf' with '%s' format specifiers without field-width limits when parsing entries from '/proc/webmon_recent_domains' and '/proc/webmon_recent_searches'. An attacker can trigger this by ensuring a long domain or search token is recorded in the web monitor logs, which are then processed when an authenticated administrator views the Web Monitor page. While the current evidence primarily supports a Denial of Service (DoS) or data corruption due to stack layout constraints, the overflow can overwrite adjacent local buffers. The Shibby Tomato project is no longer maintained and has been superseded by FreshTomato.
Affected products
- Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124
Timeline
- 2026-06-10: disclosed: Initial researcher disclosure on Gitee
- 2026-07-18: advisory: NVD/VulDB publication