| शीर्षक | Tomato Tomato by Shibby 1.28.0000 MIPSR2-124 K26 USB Big-VPN command injection |
|---|
| विवरण | `rstats` reads administrator-writable NVRAM `rstats_path`, passes it to `sub_4014AC` → `sub_4012E4`, which runs `sprintf("gzip -dc %s > /var/tmp/rstats-uncomp", path)` and `system(s)`. No shell metacharacter filtering (only `strlcpy` to 64 bytes).
Web UI **Admin → Bandwidth Monitoring** (`admin-bwm.asp`): custom path field `f_user` (max 48 chars); `v_path()` only requires a leading `/` — payloads such as `/tmp/x;touch /tmp/pwned;#` are accepted. |
|---|
| स्रोत | ⚠️ https://gitee.com/WH-YHUST/tomato-rc-nvram-cve/blob/master/gitee-cve-disclosure/advisories/en/05-rstats.md |
|---|
| उपयोगकर्ता | WH-YHUST (UID 98329) |
|---|
| सबमिशन | 17/05/2026 10:14 AM (27 दिन पहले) |
|---|
| संयम | 04/06/2026 05:32 PM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 368363 [Shibby Tomato 1.28.0000 Web UI /bin/rstats rstats_path अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|