This vulnerability affects Shibby Tomato 1.28, specifically an unknown function within the miniupnpd binary, leading to excessive resource consumption when manipulated remotely. The CVSS 4.0 score is 8.7, indicating a high impact with network attack vector, no required privileges, no user interaction, and high impact on availability. The project is no longer maintained, and no patch or official fix has been provided. The vulnerability may allow remote attackers to degrade system performance or availability by exhausting resources.

Successful exploitation can cause significant resource consumption on affected devices running Shibby Tomato 1.28, potentially leading to denial of service conditions. Since the vulnerability can be triggered remotely without authentication, it poses a risk of service disruption. However, no known exploits are reported in the wild, and the affected product is no longer supported.

No official patch or remediation is available as the product is no longer supported and has been superseded by FreshTomato. Users are advised to upgrade to a supported firmware version such as FreshTomato to mitigate this vulnerability. Until then, network-level controls such as restricting access to the miniupnpd service may reduce exposure.