PatchSiren cyber security CVE debrief
CVE-2026-10065 Shibby CVE debrief
A stack-based buffer overflow vulnerability exists in Shibby Tomato firmware version 1.28, specifically within the `get_ups_field` function of the `tomatodata.cgi` file. The vulnerability is triggered by manipulating the `Date` argument, which can be exploited remotely to achieve code execution. The affected product is end-of-life and superseded by FreshTomato, with no ongoing support from the original maintainer. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no required privileges, and high impact on confidentiality, integrity, and availability. The vulnerability was published to NVD on May 29, 2026, with a deferred status and references to VulDB and Gitee sources.
- Vendor
- Shibby
- Product
- Tomato
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations and individuals running Shibby Tomato 1.28 firmware on routers or network devices, particularly those with exposed administrative interfaces. Security teams managing legacy embedded systems and SOHO network infrastructure. MSPs supporting small business networks with Tomato-based firmware deployments.
Technical summary
The vulnerability resides in the `get_ups_field` function within `tomatodata.cgi` of Shibby Tomato firmware 1.28. Insufficient bounds checking on the `Date` parameter allows for stack-based buffer overflow when malicious input is processed. Remote attackers can exploit this weakness without authentication to potentially execute arbitrary code with elevated privileges. The attack complexity is low with no user interaction required. As Shibby Tomato is discontinued and superseded by FreshTomato, no patches are expected from the original maintainer.
Defensive priority
HIGH
Recommended defensive actions
- Migrate from Shibby Tomato 1.28 to FreshTomato or other actively maintained firmware alternatives
- If migration is not immediately possible, restrict network access to administrative interfaces implementing access control lists
- Monitor for unauthorized access attempts targeting tomatodata.cgi endpoints
- Review and validate all input handling in legacy firmware deployments
- Consider network segmentation to isolate affected devices from critical infrastructure
Evidence notes
CVE description confirms remote attack possibility and stack-based buffer overflow via Date parameter manipulation. CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) supports high severity rating. NVD status shows 'Deferred' indicating pending analysis. Vendor attribution is low confidence based on reference domain analysis pointing to Gitee. Product is explicitly noted as superseded and unsupported.
Official resources
2026-05-29