A function called setup_conntrack in the rc script of Shibby Tomato's firmware exposes an out‑of‑bounds write when the parameter ct_tcp_timeout is manipulated. Because the kernel module writes beyond its buffer, the flaw allows memory corruption that can lead to arbitrary code execution. This is a classic buffer overflow (CWE‑119) and an out‑of‑bounds write (CWE‑787).

Only the Shibby Tomato firmware 1.28 for the RT‑N5x MIPSR2 Build 124 is known to contain the vulnerable implementation of setup_conntrack; no other builds are currently listed as affected.

The CVSS score of 8.7 signals high severity, whereas the EPSS score of less than 1 % indicates a low probability of current exploitation. The vulnerability is not in the CISA KEV catalog. While the description states that the attack can be performed from remote, the exact remote interface is not explicitly documented, so this remote attack vector is inferred. Therefore a remote attacker could potentially trigger the flawed control flow by manipulating the ct_tcp_timeout argument through exposed management or network interfaces.