The vulnerability resides in Shibby Tomato firmware version 1.28.0000, in the ‘start_6rd_tunnel’ function of the /sbin/rc file accessed via the Web UI. By supplying a crafted value for the ipv6_6rd_borderrelay argument, a remote attacker can cause the router to execute arbitrary shell commands, resulting in remote code execution and full compromise of the device. The flaw is a classic OS command injection (CWE‑77/CWE‑78). The description states the attack can be launched remotely; it does not explicitly state whether authentication is required, so it is inferred that the vulnerable function does not enforce authentication.

Affected products are devices running Shibby Tomato 1.28.0000 firmware. The vulnerability is specific to the Web UI component that calls the 6rd_tunnel startup routine. No other versions or products are listed as impacted.

The CVSS score of 8.6 indicates high severity. The EPSS score of 2% shows a low probability of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. While the description indicates the exploit is public and can be launched remotely, the low EPSS suggests that exploitation in the wild is currently unlikely.