Description

A vulnerability was identified in Shibby Tomato 1.28.0000. Affected by this issue is the function new_qoslimit_start of the file /etc/qoslimit. The manipulation of the argument new_qoslimit_enable leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. This project is superseded by FreshTomato.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-06T12:16:27.103Z",
  "pubdate": "2026-08-06T12:16:27.103Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in Shibby Tomato version 1.28.0000. The vulnerability resides within the new_qoslimit_start function located in the /etc/qoslimit file. Specifically, improper neutralization of user-supplied input within the new_qoslimit_enable argument allows remote attackers to execute arbitrary operating system commands.\nThe impact of this security flaw is severe, potentially leading to complete system compromise, unauthorized access, and arbitrary code execution with the privileges of the underlying web or administrative daemon. Given that the exploit is publicly available, the risk of exploitation is elevated.\nThe affected product, Shibby Tomato 1.28.0000, is officially superseded by FreshTomato, which users are advised to migrate to. The attack vector is network-based, enabling remote threat actors to initiate exploitation without requiring prior authentication, depending on device exposure and interface configuration.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization within the new_qoslimit_start function in /etc/qoslimit. When the application processes HTTP requests or internal variables containing the new_qoslimit_enable argument, it insecurely passes the tainted parameter directly into an underlying operating system shell execution context without proper escaping or argument separation.\nThe vulnerable component is the Quality of Service (QoS) limit configuration parsing logic handled by the script or binary at /etc/qoslimit. Because the new_qoslimit_enable argument fails to restrict input to expected boolean or discrete values, an attacker can append malicious shell metacharacters (such as semicolons, pipe symbols, or backticks) followed by arbitrary OS commands.\nThe attack flow proceeds as follows: First, a remote attacker crafts a malicious HTTP request or payload targeting the vulnerable endpoint or configuration interface associated with the Qoslimit feature. Second, the request injects the crafted payload into the new_qoslimit_enable parameter. Third, the new_qoslimit_start function processes the input and executes a system call that evaluates the concatenated string via the shell.\nNetwork exposure is present if the administrative or configuration interface is accessible via the network (LAN or WAN). Authentication requirements and privilege requirements depend on whether the vulnerable interface is exposed pre-authentication or post-authentication, though the remote attack capability indicates that external exposure significantly raises the risk profile. Upon successful exploitation, the payload behavior results in arbitrary command execution, leading to potential post-exploitation activities such as backdoor installation, network pivoting, and full system takeover."
}