This vulnerability affects Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124 in the setup_conntrack function located in /sbin/rc. An attacker can remotely manipulate the ct_tcp_timeout argument to cause an out-of-bounds write, potentially leading to memory corruption. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The project is no longer maintained and has been superseded by FreshTomato. No official fix or patch has been published.

Successful exploitation allows a remote attacker with low privileges to perform an out-of-bounds write, which can lead to memory corruption. This may result in denial of service, unauthorized code execution, or system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the Shibby Tomato project is superseded by FreshTomato, it is recommended to upgrade to FreshTomato or another maintained firmware version. Until an official fix is available, restrict remote access to affected devices and monitor for suspicious activity related to connection tracking parameters.