This vulnerability involves a stack-based buffer overflow in the function sub_407220 within the /usr/sbin/httpd component of Shibby Tomato firmware versions up to 1.28.0000. The flaw exists in the DNS List Rendering functionality and can be triggered remotely without authentication or user interaction. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability has not been officially patched, and the project is now superseded by FreshTomato.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or cause a denial of service on affected devices remotely. Given the high CVSS score and the nature of a stack-based buffer overflow, the impact includes potential full compromise of the device running the vulnerable firmware.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the Shibby Tomato project is superseded by FreshTomato, users are advised to migrate to FreshTomato firmware if possible. Until an official fix is available, restricting network access to the affected service or disabling the vulnerable component may reduce exposure.