Holy shit that is scary. Package this on an android phone and you can wreak havoc on any random network
Actually it's primarily Linux because /bin/sh is pointing to bash.
In the embedded world, people rarely run full GNU userland utils. They're extremely big and bloated, and embedded devicse needs maximum bang for buck. Therefore most of them comes with busybox, which besides being incredibly compact also is 100% unaffected.
Same goes for Android/Linux-based phones. Most don't come with a proper shell at all, and those who do, usually have busybox.
If this is true, there's been a fair amount of paranoia on HN that has gone sadly unanswered with corrections.