The vulnerability CVE-2026-10124 affects Shibby Tomato firmware versions 1.0 through 1.28. It is a stack-based buffer overflow in the rip_zebra_read_ipv4 function of the ripd daemon's Zserv Handler component. An attacker can remotely trigger this overflow, potentially leading to code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The project is no longer maintained, and no official fix is available.

Successful exploitation of this vulnerability can lead to a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code or cause a denial of service on affected devices running Shibby Tomato firmware up to version 1.28. Given the high CVSS score and the remote attack vector, impacted systems are at significant risk if exposed to untrusted networks.

Since Shibby Tomato is no longer supported and no official patch or remediation is available, users should migrate to the FreshTomato project or other supported firmware alternatives. Network exposure of affected devices should be minimized or eliminated to reduce risk. Patch status is not confirmed; check vendor or community advisories for any unofficial mitigations or updates.