Read the docs
TI-2026-13087 Aliases CVE-2026-15548GHSA-8v45-wh54-g7vm

Shibby Tomato DNS List Rendering httpd sub_407220 stack-based overflow

Priority MEDIUM 41CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub_407220 of the file /usr/sbin/httpd of the component DNS List Rendering. The manipulation leads to stack-based buffer overflow. The attack is possible to be carried out remotely. This project is superseded by FreshTomato.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00792 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ShibbyTomato1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28.0000—No fix listedCNA
  • Tomato VendorShibby Affected 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15; 1.16; 1.17; 1.18; 1.19; 1.20; 1.21; 1.22; 1.23; 1.24; 1.25; 1.26; 1.27; 1.28.0000 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:*——Shibby
  • cpe:2.3:a:shibby:tomato:*:*:*:*:*:*:*:* Versions — — ·Shibby

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15548
  2. 2026-10-03 Alias added: GHSA-8v45-wh54-g7vm

References

Other 1

  • TI-2026-08826 Shibby Tomato miniupnpd resource consumption CVSS 4.0HIGH 8.7
  • TI-2026-09330 Shibby Tomato Web UI rc start_dhcpc os command injection CVSS 4.0HIGH 8.6
  • TI-2026-13474 Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow CVSS 4.0HIGH 8.7
  • TI-2026-13084 Shibby Tomato apcupsd tomatodata.cgi main out-of-bounds write CVSS 4.0HIGH 8.7
  • TI-2026-13083 Shibby Tomato apcupsd tomatodata.cgi getupsvar stack-based overflow CVSS 4.0HIGH 8.7
  • TI-2026-08877 Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow CVSS 4.0HIGH 8.7
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences