Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-16095: Shibby Tomato 1.28: Remote Code Execution through Out-of-Bounds Write
CVE-2026-16095
Summary
A flaw in Shibby Tomato's setup process allows a remote attacker to potentially execute malicious code on the router. This issue affects users who have not updated to a newer version of the software, specifically Shibby Tomato 1.28 for the RT-N5x router. Users are advised to consider updating to a newer version, such as FreshTomato, which is a more recent and possibly more secure alternative.
Original title
A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation of the argument ct_tcp_tim...
Original description
A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation of the argument ct_tcp_timeout can lead to out-of-bounds write. The attack may be performed from remote. This project is superseded by FreshTomato.
nvd CVSS2.0
9.0
nvd CVSS3.1
8.8
nvd CVSS4.0
8.7
Vulnerability type
CWE-119
Buffer Overflow
CWE-787
Out-of-bounds Write
Published: 18 Jul 2026 · Updated: 20 Jul 2026 · First seen: 18 Jul 2026