A stack-based buffer overflow exists in the Shibby Tomato component Zserv Handler, specifically within the rip_zebra_read_ipv4 function. The flaw is triggered by manipulating a packet processed by /usr/sbin/ripd and, because the overflow occurs on the stack, an attacker can inject malicious code or corrupt execution flow. The vulnerability is classified as CWE‑119 and CWE‑121 and enables remote code execution when an untrusted client sends crafted RIP messages.

The flaw affects Shibby Tomato versions up to 1.28, a product that is no longer maintained. The affected code resides in the ripd service of the Zserv Handler component, and the product has been superseded by FreshTomato.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available but the exploit has been publicly disclosed, implying that attackers could deploy it. Because the attack vector is remote, systems exposed to the internet or an internal untrusted network are at risk. The vulnerability is not yet listed in the CISA KEV catalog, but the lack of active support for Shibby Tomato means that no official fix is currently offered, raising the likelihood that exploitation attempts will succeed.