CVE-2026-15548

Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow

View on CVE.org
Published Jul 13, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.

Analysis

AI-generated

Technical impact

A stack‑based buffer overflow occurs in the sub_407220 function of the /usr/sbin/httpd daemon within the DNS List Rendering component of Shibby Tomato firmware. The overflow is triggered by malformed input received through the HTTP interface, which can corrupt the stack and potentially allow an attacker to execute arbitrary code on the device. The impact is a complete compromise of the affected system, including loss of confidentiality, integrity, and availability.

Affected Systems

Firmware versions up to 1.28.0000 of Shibby Tomato are vulnerable. The vulnerability status of later releases and the FreshTomato project is not documented in the available data.

Risk and Exploitability

The CVSS score of 8.7 reflects high severity due to full remote exploitation potential and no authentication requirements. The EPSS score of less than 1% indicates a low probability of current exploitation. The likelihood of attack is remote, reachable via the network-facing httpd service, and an attacker can trigger the overflow without needing local access.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Shibby Tomato to a firmware version newer than 1.28.0000. It is uncertain whether FreshTomato includes the fix, as the vulnerability status there is not documented. This update addresses the stack‑based buffer overflow associated with CWE‑119 and CWE‑121.
  • If a firmware upgrade cannot be performed immediately, restrict access to the httpd DNS List Rendering interface by implementing firewall rules or NAT to trusted hosts only, thereby mitigating remote exploitation of the overflow bug.
  • Deploy continuous monitoring of device logs for abnormal HTTP requests or signs of exploitation, and configure alerts for repeated failed parsing attempts to detect potential attacks early.

Generated by OpenCVE AI on July 31, 2026 at 11:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.
Title Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow
First Time appeared Shibby
Shibby tomato
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*
Vendors & Products Shibby
Shibby tomato
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 2:13 PM
Reserved
Jul 12, 2026, 9:01 PM

View source JSON

Updated
Jul 15, 2026, 2:13 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 10:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 12:00 PM

JSON