Description
A flaw has been found in Shibby Tomato 1.28. The affected element is the function send of the file usr/sbin/miniupnpd of the component SUBSCRIBE Call Handler. This manipulation causes server-side request forgery. The attack may be initiated remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS 7.3EPSS 0.27799999999999997%Risk 0.75
View source- Published
- 2026-05-29 16:16:23
- Affected versions
- ==1.28
- Type
- Firmware
- Last modified
- 2026-07-21 15:10:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L