The big problem with shellshock is that the attack surface is found pretty much everywhere. The HTTP server attacks using the CGI environment (HTTP_USER_AGENT,

The big problem with shellshock is that the attack surface is found pretty much everywhere. The HTTP server attacks using the CGI environment (HTTP_USER_AGENT, etc) was only the most obvious way to exploit the bug. There is no way to predict all the ways a vulnerable bash could be exploited; we are going to see these attack for decades. Old firmware and poorly-maintained servers are just waiting for someone to find some clever trick that lets an environment variable be set remotely. I would guess that we haven't even begun to see the subtle ways shellshock can be exploited. So yes, patch everything, or you are taking a bet that there will not be any sufficiently clever attackers in the entire future lifetime the server.