Description
A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.
Published: 2026-07-13
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow occurs in the sub_407220 function of the /usr/sbin/httpd daemon within the DNS List Rendering component of Shibby Tomato firmware. The overflow is triggered by malformed input received through the HTTP interface, which can corrupt the stack and potentially allow an attacker to execute arbitrary code on the device. The impact is a complete compromise of the affected system, including loss of confidentiality, integrity, and availability.

Affected Systems

Firmware versions up to 1.28.0000 of Shibby Tomato are vulnerable. The vulnerability status of later releases and the FreshTomato project is not documented in the available data.

Risk and Exploitability

The CVSS score of 8.7 reflects high severity due to full remote exploitation potential and no authentication requirements. The EPSS score of less than 1% indicates a low probability of current exploitation. The likelihood of attack is remote, reachable via the network-facing httpd service, and an attacker can trigger the overflow without needing local access.

Generated by OpenCVE AI on July 31, 2026 at 11:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Shibby Tomato to a firmware version newer than 1.28.0000. It is uncertain whether FreshTomato includes the fix, as the vulnerability status there is not documented. This update addresses the stack‑based buffer overflow associated with CWE‑119 and CWE‑121.
  • If a firmware upgrade cannot be performed immediately, restrict access to the httpd DNS List Rendering interface by implementing firewall rules or NAT to trusted hosts only, thereby mitigating remote exploitation of the overflow bug.
  • Deploy continuous monitoring of device logs for abnormal HTTP requests or signs of exploitation, and configure alerts for repeated failed parsing attempts to detect potential attacks early.

Generated by OpenCVE AI on July 31, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.
Title Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow
First Time appeared Shibby
Shibby tomato
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*
Vendors & Products Shibby
Shibby tomato
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Shibby Tomato
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T14:13:38.229Z

Reserved: 2026-07-12T21:01:09.003Z

Link: CVE-2026-15548

cve-icon Vulnrichment

Updated: 2026-07-15T14:13:32.047Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T12:00:05Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow