🚨 HIGH - Remote out-of-bounds write in Shibby Tomato conntrack setup (CVE-2026-16095) A high-severity vulnerability in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 impacts the setup_conntrack function in /sbin/rc, where the ct_tcp_timeout argument is processed unsafely. The root cause is an out-of-bounds write due to improper input validation and unsafe bounds handling of the timeout parameter. An attacker can exploit this remotely by sending crafted inputs that influence ct_tcp_timeout during configuration/connection tracking setup, without requiring local access. Successful exploitation can corrupt memory and lead to denial of service and potentially remote code execution, with downstream impact to confidentiality, integrity, and availability. 👉 Affected: Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 | Upgrade to No fix yet — treat as suspicious
Post summary
A high‑severity remote out‑of‑bounds write vulnerability (CVE‑2026‑16095) in Shibby Tomato’s setup_conntrack function is disclosed; no patch or exploitation code is provided and the issue remains unfixed.
