🚨High - Shibby Tomato Scheduler Name Handler Stack Overflow (CVE-2026-16097) Shibby Tomato 1.28, a community fork of the Tomato router firmware, contains a stack-based buffer overflow in the function sub_42537C of the Scheduler Name Handler. Manipulating the argument a1 corrupts the stack, and the attack can be launched remotely. The CVSS vectors indicate an authenticated (admin-panel) attacker with full confidentiality/integrity/availability impact, i.e. potential code execution on the router. CVSS 8.7. Note: Shibby Tomato is discontinued and superseded by FreshTomato, so no fix is expected. 👉Affected: Shibby Tomato 1.28. Migrate to FreshTomato and restrict access to the router admin interface.
Post summary
A high‑severity stack overflow in Shibby Tomato router firmware is disclosed; no patch is available, so users are advised to migrate and restrict admin interface access.
