CVE-2026-16096

Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow

State: Published
Severity: 8.7 High
Published: Jul 18, 2026
Updated: Jul 22, 2026
Reserved: Jul 17, 2026

Description

A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub_40BB50 of the file /proc/webmon_recent_domains. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. This project is superseded by FreshTomato.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X	VulDB
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R	VulDB
3.0	8.8 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R	VulDB
2.0	9.0 High	AV:N/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:UR	VulDB

Weaknesses

CWE-121 Stack-based Buffer Overflow
CWE-119 Memory Corruption

Affected Products

Product	Versions
TomatoShibby	1.28 RT-N5x MIPSR2 Build 124Affected

References

VDB-379800 | Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflowvdb-entrytechnical-description
VDB-379800 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-16096 | CVE Analysis and Reportthird-party-advisory
Submit #855124 | Tomato by Shibby Tomato Firmware Tomato v1.28 RT-N5x MIPSR2 build 124 Mini Stack-based Buffer Overflowthird-party-advisory
https://gitee.com/Fengyi-Wang/CVE/issues/IJTQ5Tissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.