This vulnerability in Shibby Tomato 1.28 involves a stack-based buffer overflow in the Scheduler Name Handler's function sub_42537C. An attacker can remotely manipulate the argument a1 to trigger the overflow, potentially leading to code execution or denial of service. The CVSS 4.0 score is 8.7, reflecting high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The project is no longer maintained and has been superseded by FreshTomato. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service due to the stack-based buffer overflow. The attacker can exploit this remotely without user interaction and with low privileges, resulting in high impact on confidentiality, integrity, and availability of the affected device running Shibby Tomato 1.28.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project is superseded by FreshTomato, consider migrating to FreshTomato as a potential mitigation. Until an official fix is available, restrict network access to the affected device and monitor for suspicious activity related to this vulnerability.