🛠️ **Root Cause**: Improper neutralization of special elements used in an OS command (**CWE-78**). The `new_qoslimit_enable` parameter is not sanitized before being passed to the shell.
Q3影响谁？（版本/组件）
📦 **Affected**: **Shibby Tomato 1.28.0000** (specifically MIPSR2-124 K26 Mini build). ⚠️ Note: This project is **deprecated** and replaced by FreshTomato.
Q4黑客能干啥？（权限/数据）
👑 **Privileges**: **Root/System Level**. The CVSS score (H/H/H) indicates complete impact on Confidentiality, Integrity, and Availability. Hackers gain full control over the router.
Q5利用门槛高吗？（认证/配置）
🔐 **Threshold**: **High Privileges Required**. CVSS vector `PR:H` means the attacker must already have **authenticated access** to the router's admin interface to trigger this injection.
Q6有现成Exp吗？（PoC/在野利用）
💣 **Public Exploit**: **YES**. Exploit code is publicly available (referenced in Gitee). This increases the risk of automated or scripted attacks by threat actors.
Q7怎么自查？（特征/扫描）
🔍 **Self-Check**: Scan for **Shibby Tomato 1.28.0000** firmware versions. Check if the `/etc/qoslimit` script exists and if the `new_qoslimit_start` function is present in the admin panel's QoS settings.
Q8官方修了吗？（补丁/缓解）
🩹 **Official Fix**: **NO**. The project is **dead**. It has been superseded by **FreshTomato**. No patches will be released for Shibby Tomato.
Q9没补丁咋办？（临时规避）
🛡️ **Workaround**: **Migrate immediately**. Upgrade to **FreshTomato** or another supported firmware. If stuck, disable remote admin access and restrict local network access to trusted users only.
Q10急不急？（优先级建议）
⚡ **Urgency**: **HIGH** for affected users. Since exploits are public and the software is unsupported, immediate migration to a maintained alternative is critical to prevent compromise.