Log in Start free

Vulnerability · Published May 30, 2026 · Assigned by VulDB

CVE-2026-10124Shibby Tomato Zserv ripd rip_zebra_read_ipv4 stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in Tomato from Shibby. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 59.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products (as reported)

VendorProductVersions
Shibby Tomato 1.01.11.21.31.41.51.61.7

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References