A stack-based buffer overflow exists in the function sub_9068 of the tomatoups.cgi script used by the UPS Service component of Shibby Tomato firmware. The vulnerability allows an attacker to corrupt the call stack and gain arbitrary code execution on the device, potentially exposing sensitive configuration and compromising the entire networked environment. Error handling is insufficient and the buffer size is not validated against user input, satisfying CWE-119 and CWE-121 weaknesses. The vulnerability is considered high severity with a CVSS score of 8.7.

Devices running Shibby Tomato firmware version 1.28 or earlier are impacted. The affected software component is the UPS Service embedded in the firmware; newer firmware releases replace or remove this component, and the vulnerability does not affect the actively maintained FreshTomato code base.

The flaw can be exploited remotely without user interaction, as the vulnerable CGI script is exposed via web interfaces commonly used to manage the UPS. Although no EPSS score is available, the high CVSS rating and the fact that the flaw is publicly documented on multiple advisory sites imply a realistic threat of exploitation. The vulnerability is not listed in the CISA KEV, but its potential for remote code execution warrants proactive mitigation. The attack path is straightforward: a remote user submits carefully crafted input to the sub_9068 endpoint, causing a stack overflow that ultimately leads to arbitrary code execution.