Cyber Resilience

CVE-2026-15545

Memory Safety

Published
13 July 2026
Modified
13 July 2026
CVSS Score v4 7.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0040 32th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-15545 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Gitee (inferred from references). Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of the file www/apcupsd/tomatodata.cgi of the component apcupsd. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit…

more

is publicly available and might be used. This project is superseded by FreshTomato.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote out-of-bounds write in a public-facing CGI script (tomatodata.cgi) directly enables exploitation of the web application for initial access or code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-10114Shared CWE-119, CWE-787
CVE-2026-13592Shared CWE-119, CWE-787
CVE-2026-3703Shared CWE-119, CWE-787
CVE-2026-2940Shared CWE-119, CWE-787
CVE-2026-16095Shared CWE-119, CWE-787
CVE-2025-0568Shared CWE-119, CWE-787
CVE-2025-0569Shared CWE-119, CWE-787
CVE-2026-16225Shared CWE-119, CWE-787
CVE-2025-8159Shared CWE-119, CWE-787
CVE-2026-4211Shared CWE-119, CWE-787

Affected Assets

Gitee
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V17.3.2

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces validation of all inputs to the tomatodata.cgi script, blocking the malformed data that triggers the out-of-bounds write.

prevent

Applies memory-protection mechanisms (e.g., ASLR, non-executable stacks) that render successful exploitation of the CWE-787 write far more difficult.

prevent

Requires prompt application of patches or replacement firmware (FreshTomato) that eliminate the vulnerable apcupsd CGI code.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices (bounds checking, safe APIs, reviews) directly prevent this class of flaw.

ID.RA-01 partial match
prevents

Vulnerability scanning and code analysis directly surface buffer-boundary flaws.

ID.RA-08 partial match
prevents

Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.

PR.AT-02 partial match
prevents

Developer training on secure coding reduces introduction of memory-buffer errors.

PR.PS-02 partial match
prevents

Patching replaces vulnerable code containing buffer-boundary defects.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.

prevents

Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.

prevents

Application security requirements can specify memory-safety rules, but do not prescribe implementation details.

prevents

Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.

prevents

Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.

prevents

Change management can enforce review gates that catch unsafe memory operations before deployment.

References