Description
A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This manipulation of the argument Field causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.
Published: 2026-07-13
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow exists in the getupsvar function of tomatodata.cgi, triggered by manipulating the Field argument. This flaw is identified as CWE‑119 and CWE‑121. If successfully exploited, it could allow remote attackers to crash the service or potentially execute arbitrary code on the device. The vulnerability is remote‑initiated, has been publicly disclosed, and may be utilized.

Affected Systems

Shibby Tomato devices running version 1.28.0000 or older, specifically the apcupsd component exposed at www/apcupsd/tomatodata.cgi, are affected.

Risk and Exploitability

The CVSS score of 8.7 denotes high severity. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; a public exploit has been disclosed, but real‑world exploitation remains unlikely at present.

Generated by OpenCVE AI on August 1, 2026 at 10:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Shibby Tomato to a version newer than 1.28.0000 or migrate to the supported FreshTomato release.
  • Apply any vendor‑supplied patch that addresses the getupsvar buffer overflow.
  • Restrict remote access to the apcupsd endpoint by configuring firewall rules or network segmentation.

Generated by OpenCVE AI on August 1, 2026 at 10:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcupsd/tomatodata.cgi of the component apcupsd. This manipulation of the argument Field causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.
Title Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow
First Time appeared Shibby
Shibby tomato
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*
Vendors & Products Shibby
Shibby tomato
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Shibby Tomato
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-13T15:23:20.254Z

Reserved: 2026-07-12T21:00:57.952Z

Link: CVE-2026-15544

cve-icon Vulnrichment

Updated: 2026-07-13T15:23:15.251Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T11:00:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow