Wh-Yhust

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** An OS command injection flaw exists in the `new qoslimit stop()` function within the `/tmp/qoslimittc stop.sh` file. A remote attacker can exploit this by manipulating the `wan iface` argument to execute arbitrary operating system commands. **Recommendations** For version 1.28.0000, migrate to FreshTomato, as the Shibby Tomato project has been superseded by it.

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** An OS command injection flaw exists in the `new qoslimit start()` function located in the `/etc/qoslimit` file. A remote attacker can trigger this issue by manipulating the `new qoslimit enable` argument. OS command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device. **Recommendations** As a temporary workaround, consider restricting access to the `new qoslimit start()` function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** A remote OS command injection flaw exists in the `sub 40F88C()` function within the `/tmp/ppp/wanoptions` file. This issue occurs when the `ppp custom` argument is manipulated, allowing an attacker to execute arbitrary operating system commands remotely. **Recommendations** As a temporary workaround, restrict access to the `ppp custom` argument in the `/tmp/ppp/wanoptions` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** An OS command injection flaw exists in the Web UI component. The issue is located in the `start dhcpc()` function within the `/sbin/rc` file, allowing a remote attacker to execute arbitrary operating system commands. **Recommendations** Update Shibby Tomato version 1.28.0000 to FreshTomato, as the former project has been superseded by the latter. As a temporary workaround, restrict access to the Web UI component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** An OS command injection flaw exists in the Web UI component within the `rstats path()` function of the `/bin/rstats` file. This issue allows a remote attacker to execute arbitrary system commands through manipulation. **Recommendations** Update Shibby Tomato version 1.28.0000 to FreshTomato, as the original project has been superseded.

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** An OS command injection issue exists in the Web UI component within the `/sbin/rc` file. The flaw occurs in the `start 6rd tunnel()` function when the `ipv6 6rd borderrelay` argument is manipulated, allowing a remote attacker to execute arbitrary system commands. **Recommendations** Update Shibby Tomato version 1.28.0000 to FreshTomato. As a temporary mitigation, restrict access to the Web UI component to prevent remote manipulation of the `ipv6 6rd borderrelay` argument.

**Name of the Vulnerable Software and Affected Versions** Shibby Tomato version 1.28.0000 **Description** An OS command injection issue exists in the Web UI component within the `start vpnserver()` function of the `/sbin/rc` file. This flaw allows a remote attacker to execute arbitrary operating system commands through manipulation. **Recommendations** For version 1.28.0000, as a temporary workaround, restrict access to the `start vpnserver()` function in the Web UI. At the moment, there is no information about a newer version that contains a fix for this vulnerability.