This vulnerability resides in the get_ups_field function of the tomatodata.cgi script in Shibby Tomato version 1.28. By supplying a specially crafted Date argument the attacker can overflow a stack buffer, a condition identified as CWE-119 and CWE-121. The flaw is exploitable remotely and carries a CVSS score of 8.7, indicating a high likelihood of serious impact if successfully mined.

It affects only the Shibby Tomato product in its 1.28 release. The vendor has marked this version as no longer supported and notes that the product is superseded by FreshTomato. Devices running this firmware are therefore on an unsupported code base with no official patch provisioned.

Because the overflow is triggered via a remote HTTP parameter, an attacker only needs to reach the web interface to exercise the exploit. The EPSS metric is not available, and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score and the remote nature of the attack still warrant a high level of concern. There are no known mitigations from the vendor; the risk remains until the firmware is replaced or the endpoint is isolated.