CVE-2025-34148 — Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WISP SSID
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in WISP mode, the 'ssi…
Published: 2025-08-07 · CVSS: 9.4 · CVSS 4.0
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in WISP mode, the 'ssid' parameter is passed unsanitized to system-level scripts. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root, resulting in full device compromise.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7