The flaw allows an attacker to inject arbitrary operating‑system commands via the start_dhcpc function in the Shibby Tomato web interface. This is an instance of CWE‑77 (OS Command Injection) and CWE‑78 (OS Command Injection). Successful exploitation grants the attacker the ability to run arbitrary commands with the privileges of the web UI process, effectively creating a remote code execution vector.

Shibby Tomato version 1.28.0000, specifically the /sbin/rc script that implements the start_dhcpc function. The vulnerability is present in the Web UI component of the Tomato firmware distributed by Shibby.

The CVSS score of 8.6 classifies this flaw as high severity. The EPSS score of 2% indicates a relatively low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The exploit is remote, requiring only web UI access, and published exploits exist, indicating a realistic risk of exploitation. The absence of an official fix implies attackers could perform the injection under any circumstances where the web interface is reachable.