CVE-2026-10066: Shibby Tomato UPS Service tomatoups.cgi sub_9068 stack-based overflow

Synopsis

A stack-based buffer overflow exists in the sub_9068 function of tomatoups.cgi in the UPS Service component of Shibby Tomato through version 1.28. The flaw is reachable over the network and requires a low-privilege account, and a successful exploit lets the attacker corrupt the service's stack memory to read sensitive memory, tamper with router state, or crash the service. The project is end-of-life (superseded by FreshTomato) and no fix has been published, so HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the tomatoups.cgi endpoint over the network (AV:N).

• AuthenticationRequired

  A low-privilege account on the device is sufficient to invoke the vulnerable function (PR:L).

• Victim interactionNot required

  No user action is needed; the attacker triggers the overflow directly (UI:N).

• Attack complexityDetail

  Attack complexity is low, so the exploit is reliable and free of timing or environmental preconditions (AC:L).

Blast Radius

• Reads stack memory and adjacent process data from the UPS Service, exposing credentials and router configuration.
• Overwrites the call stack to alter UPS Service control flow and tamper with router state.
• Crashes tomatoups.cgi and disrupts UPS monitoring on the affected router.