Threats tagged 'ghsa-p42c-v74f-mh4c'

CVE-2026-19034 is a remote OS command injection vulnerability in Shibby Tomato version 1.28.0000. It affects the new_qoslimit_stop function in the /tmp/qoslimittc_stop.sh script. An attacker with high privileges can manipulate the wan_iface argument to execute arbitrary OS commands. The vulnerability has a high severity score of 7.2 and has been publicly disclosed with exploit code available. The Shibby Tomato project is now superseded by FreshTomato.