A vulnerability has been found in Shibby Tomato 1

CVE-2026-16096 is a stack-based buffer overflow in the sub_40BB50 routine of Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) — specifically in the code that handles the /proc/webmon_recent_domains interface exposed through the router's httpd web UI. A crafted request writes past the allocated stack buffer and can corrupt the return address, giving a remote authenticated attacker the ability to hijack the MIPS control flow and execute code as the router's httpd process (typically root on Tomato). Affected: Shibby Tomato 1.28, RT-N5x MIPSR2, Build 124 (and by structural similarity likely earlier Shibby builds sharing the same webmon code). No fix will ship — Shibby Tomato has been end-of-life for years; the successor project is FreshTomato.

Vendor severity of HIGH (8.8) with PR:L is defensible on paper — authenticated web-UI RCE on a network edge device sounds bad. But the score assumes an accessible, patchable, deployed-at-scale product. This is dead consumer firmware on ~15-year-old Broadcom SoHo hardware (RT-N16/N66U class). The realistic population is hobbyist home routers and a long tail of neglected small-office boxes. In an enterprise fleet of 10,000 hosts this CVE should almost never appear; if it does, it's shadow-IT hardware that needs to be removed, not patched.

Why this verdict

• Authentication required (PR:L) — the attacker needs valid router admin credentials before they can touch sub_40BB50. That single prerequisite eliminates opportunistic mass exploitation.
• LAN-only exposure by default — Tomato ships with WAN admin disabled; internet-reachable Shibby Tomato admin panels are a rounding error in Shodan.
• Installed base is hobbyist SoHo, not enterprise — RT-N5x MIPSR2 hardware is a decade-plus old Broadcom class of consumer routers. If it appears in a corporate scan, it is shadow IT.
• Role multiplier: on the realistic deployment (SoHo home/hobbyist router), a compromise ends at the household or a single small branch — no fleet, no identity, no domain implication. There is no high-value-role variant of Shibby Tomato because the product itself is not deployed in high-value roles; enterprise gateways use Palo/Fortinet/Cisco, not abandoned OSS forks.
• No fix path — because Shibby is EOL, remediation is *replace the device or reflash to FreshTomato*, which is an asset-lifecycle action, not a patch cycle. This further argues for a MEDIUM 'plan to remove' verdict rather than a HIGH 'patch now' verdict.

Why not higher?

HIGH would be defensible only if there were an internet-exposed unauthenticated path or an active exploitation campaign. Neither exists: PR:L is baked into the vector, WAN admin is off by default, and there is no PoC or KEV listing. The vendor's 8.8 over-weights a theoretical worst case against the real installed base.

Why not lower?

LOW/IGNORE would be wrong because when Shibby Tomato *does* appear in an environment, successful exploitation is root on a network gateway with DNS-hijack and MitM potential. Anyone with a Shibby router still in production has a real, if narrow, RCE they need to resolve — even if the resolution is decommission rather than patch.

1. Inventory and eliminate Shibby Tomato from the environment — Scan for the Tomato Firmware HTTP banner on internal ranges (Nmap http-title, or a targeted curl sweep). Any hits are almost certainly unmanaged SoHo hardware; retire and replace with a supported edge device. Complete inventory within the noisgate MEDIUM 365-day remediation window — no artificial mitigation SLA applies.
2. If retention is unavoidable, flash the device to FreshTomato — FreshTomato is the maintained fork and does not carry the abandoned Shibby webmon code. This is the only vendor-blessed 'patch' available.
3. Change the router admin password and disable WAN admin — Because the vector requires authentication, credential hygiene is the highest-leverage control. Confirm Administration → Admin Access → Allow Wireless Access and Remote Access are disabled. Rotate admin credential to a 20+ char random secret stored in your password manager.
4. Segment the router off management VLANs — Even if you cannot remove it, ensure the device does not have a path to Active Directory, jump hosts, or backup infrastructure. Blocks lateral movement if a router is compromised.
5. Alert on the Tomato admin banner appearing on any monitored subnet — Add a passive detection to your scanner (Nessus/Qualys custom check, or a scheduled nmap --script http-title job) that opens a ticket the moment a Tomato device shows up. Prevents recurrence.

Run this from an auditor workstation on the same L2/L3 segment as the suspect router. Invoke as ./check_shibby.sh 192.168.1.1 (or a CIDR-expanded target list). Requires only curl and standard user privileges. Outputs VULNERABLE, PATCHED, or UNKNOWN per host.

#!/usr/bin/env bash
# noisgate check for CVE-2026-16096 — Shibby Tomato 1.28 RT-N5x Build 124
# Usage: ./check_shibby.sh <ip-or-host>
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <ip-or-host>" >&2
  exit 2
fi

CURL=(curl -sS -k --max-time 5 -o /dev/null -w '%{http_code} %{content_type}\n')

# 1) Probe common Tomato admin ports
BANNER=""
for SCHEME_PORT in "http://${TARGET}:80" "https://${TARGET}:443" "http://${TARGET}:8080"; do
  RESP=$(curl -sS -k --max-time 5 -D - "${SCHEME_PORT}/" 2>/dev/null | head -n 40)
  if echo "$RESP" | grep -qiE 'Tomato|WWW-Authenticate:.*Tomato'; then
    BANNER="$RESP"
    ENDPOINT="$SCHEME_PORT"
    break
  fi
done

if [[ -z "$BANNER" ]]; then
  echo "${TARGET}: UNKNOWN (no Tomato banner observed)"
  exit 0
fi

# 2) Look for Shibby build fingerprint
SHIBBY=$(curl -sS -k --max-time 5 "${ENDPOINT}/about.asp" 2>/dev/null | grep -Eoi 'Shibby[^<"]{0,64}|Build[[:space:]]*12[0-9]|1\.28' | tr '\n' ' ')

if echo "$SHIBBY" | grep -qi 'Shibby' && echo "$SHIBBY" | grep -qE 'Build[[:space:]]*124|1\.28'; then
  echo "${TARGET}: VULNERABLE (Shibby Tomato 1.28 / Build 124 fingerprint: ${SHIBBY})"
  exit 1
fi

if echo "$BANNER" | grep -qi 'FreshTomato'; then
  echo "${TARGET}: PATCHED (FreshTomato detected)"
  exit 0
fi

echo "${TARGET}: UNKNOWN (Tomato-family device, but Shibby 1.28/Build 124 not confirmed)"
exit 0

Sources

1. TheHackerWire — Shibby Tomato 1.28 Remote Stack Buffer Overflow
2. TheHackerWire — Related Shibby Tomato OOB Write (CVE-2026-16095)
3. TheHackerWire — CVE-2026-16097 Shibby Tomato Stack Overflow
4. CISA Vulnerability Summary Bulletin (June 2026)
5. VulDB CVE index (Tomato entries)
6. FreshTomato project (maintained successor)
7. CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
8. LinksysInfo forum thread on Shibby Tomato K26USB 1.28 RT-N5x