This vulnerability exists in Shibby Tomato 1.28.0000, specifically in the start_dhcpc function of the /sbin/rc file related to the Web UI. An attacker can remotely trigger OS command injection due to improper input handling. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Although exploit code is publicly available, there is no vendor-provided fix or official remediation guidance. The project is no longer actively maintained, having been superseded by FreshTomato.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on affected devices, potentially leading to full system compromise. This can result in unauthorized access, data manipulation, or denial of service. Given the high CVSS score and the nature of the vulnerability, affected systems are at significant risk if exposed to untrusted networks.

No official patch or remediation is currently available for Shibby Tomato 1.28.0000. Users are advised to migrate to the FreshTomato project, which supersedes Shibby Tomato and may offer improved security. Until migration, affected devices should be isolated from untrusted networks to prevent remote exploitation. Monitor vendor advisories for any future updates or patches.