This vulnerability affects Shibby Tomato firmware versions up to 1.28.0000 in the apcupsd component's getupsvar function. A specially crafted argument Field can cause a stack-based buffer overflow, which can be exploited remotely without user interaction or privileges beyond low-level access. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction. The exploit has been publicly disclosed, but no official fix or patch is currently available. The Shibby Tomato project is no longer maintained and has been superseded by FreshTomato.

Successful exploitation of this vulnerability may allow remote attackers to execute arbitrary code or cause a denial of service on affected devices running Shibby Tomato up to version 1.28.0000. The vulnerability is exploitable remotely without user interaction, increasing the risk of compromise. Given the high CVSS score and the nature of the flaw (stack-based buffer overflow), the impact includes potential full system compromise.

No official patch or remediation is currently available for this vulnerability. Since the Shibby Tomato project is superseded by FreshTomato, users are advised to migrate to FreshTomato firmware or other maintained alternatives. Until migration, affected devices should be isolated from untrusted networks to reduce exposure. Monitor vendor advisories for any future updates or patches.