Tomato (<= 1.28.0000) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tomato--1.28.0000/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 13 Jul 2026 08:28:06 +0000Shibby Tomato Firmware Vulnerability CVE-2026-15544 Enables Remote Code Executionhttps://feed.craftedsignal.io/briefs/2026-07-shibby-tomato-cve-2026-15544/Mon, 13 Jul 2026 08:28:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-shibby-tomato-cve-2026-15544/A stack-based buffer overflow vulnerability, identified as CVE-2026-15544, exists in the `getupsvar` function within the `www/apcupsd/tomatodata.cgi` file of the `apcupsd` component in Shibby Tomato firmware versions up to and including 1.28.0000, allowing a remote attacker to achieve arbitrary code execution by manipulating the `Field` argument.A critical stack-based buffer overflow vulnerability, tracked as CVE-2026-15544, has been identified in Shibby Tomato firmware versions up to 1.28.0000. This flaw specifically affects the getupsvar function within the www/apcupsd/tomatodata.cgi file, part of the apcupsd component. By manipulating the Field argument, an attacker can trigger the buffer overflow, leading to remote code execution. This vulnerability can be exploited remotely, and details of the exploit have been publicly disclosed, increasing the risk of active exploitation. The Shibby Tomato project has been superseded by FreshTomato, indicating that official updates for the vulnerable versions may not be available, leaving affected devices exposed to significant risk.

Attack Chain

  1. Attacker identifies an internet-facing Shibby Tomato device running a vulnerable firmware version (up to 1.28.0000).
  2. The attacker crafts a malicious HTTP request targeting the www/apcupsd/tomatodata.cgi endpoint on the vulnerable device.
  3. The crafted request includes a specially malformed or excessively long Field argument designed to overflow a buffer.
  4. The getupsvar function in the apcupsd component processes the malicious Field argument without proper bounds checking.
  5. A stack-based buffer overflow occurs, overwriting critical data on the stack.
  6. The attacker injects and executes arbitrary code on the affected Shibby Tomato device, achieving remote code execution.
  7. The attacker gains full control over the compromised router, potentially allowing for network pivoting, data exfiltration, or further malicious activities.

Impact

Successful exploitation of CVE-2026-15544 leads to remote code execution (RCE) on the vulnerable Shibby Tomato device. This grants attackers full control over the compromised router, enabling them to alter device settings, hijack network traffic, establish persistence, or use the device as a pivot point for further attacks into the internal network. Given that these devices often act as network gateways, an RCE can have severe consequences, compromising the entire network behind the router. The public disclosure of the exploit increases the likelihood of widespread attacks against unpatched devices. There is no information available on specific victims or sectors at this time.

Recommendation

  • Upgrade Shibby Tomato firmware to a patched version if available, or migrate to FreshTomato as the project is superseded.
  • Apply available patches for CVE-2026-15544 immediately to all Shibby Tomato devices running affected versions up to 1.28.0000.
  • Limit network exposure of administrative interfaces for devices running apcupsd to trusted networks only.
]]>highthreatbuffer-overflowrcefirmwareroutercve