CVE-2026-10065: Shibby Tomato tomatodata.cgi get_ups_field stack-based overflow

Synopsis

A stack-based buffer overflow in the get_ups_field function of tomatodata.cgi in Shibby Tomato 1.28 lets a remote, authenticated attacker corrupt the CGI process's stack by manipulating the Date argument. The router firmware is reachable over the network and only needs a low-privilege account, and successful exploitation enables full compromise of the device with attacker-controlled code execution against the web management interface. The project is no longer maintained (superseded by FreshTomato) and no fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the tomatodata.cgi endpoint over the network, typically the router's HTTP management interface.

• AuthenticationRequired

  A low-privilege account on the Tomato web UI is sufficient to invoke the vulnerable CGI handler.

• Victim interactionNot required

  No user action is needed; the attacker sends the crafted Date argument directly.

• Attack complexityDetail

  Attack complexity is low, meaning the overflow triggers reliably without race conditions or special environmental setup.

Blast Radius

• Executes attacker-controlled code in the context of the router's CGI process, typically running with elevated privileges on the device.
• Reads any data handled by the router including stored credentials, VPN keys, and configuration secrets.
• Modifies firmware configuration, routing rules, and persisted settings to maintain access or pivot into the internal network.
• Disrupts the management interface and broader router availability, potentially knocking the device offline.