Which versions of M300 Wi-Fi Repeater are affected by CVE-2026-19348?

The Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) contains a critical remote command injection vulnerability (CVE-2026-19348) allowing unauthenticated attackers to execute arbitrary OS…

Is there a public PoC exploit available for CVE-2026-19348?

Yes, a public proof-of-concept exploit is available for CVE-2026-19348. Prioritise patching immediately. EPSS: 2.5%.

How to fix or mitigate CVE-2026-19348?

Within 24 hours, conduct a comprehensive inventory of all Shenzhen Aitemi M300 Wi-Fi Repeaters to identify devices running firmware r0-ea7890a and assess their network placement within critical infrastructure. Within 7 days, either isolate all affected devices to a segregated guest network with no access to critical systems or replace them with Wi-Fi repeaters from vendors providing active security support. Within 30 days, implement network segmentation to restrict repeater trust levels, deploy intrusion detection monitoring for suspicious command execution patterns, and complete replacement of any remaining Aitemi M300 units in your environment.

M300 Wi-Fi Repeater CVE-2026-19348

Q: What is the CVSS score of CVE-2026-19348?

CVE-2026-19348 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.5%.

EUVD-2026-54917 HIGH

Command Injection (CWE-77)

2026-08-09 VulDB

GHSA-5x4f-6m9q-mg75

Command Injection M300 Wi Fi Repeater

8.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

8.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable CGI endpoint with no authentication (consistent with CVSS 4.0 PR:N), no complexity barriers, and full device compromise with no scope change beyond the affected repeater.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 09, 2026 - 11:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 09, 2026 - 11:22 vuln.today

cvss_changed

Severity Changed

Aug 09, 2026 - 11:22 NVD

CRITICAL HIGH

CVSS changed

Aug 09, 2026 - 11:22 NVD

9.3 (CRITICAL) 8.9 (HIGH)

Analysis Generated

Aug 09, 2026 - 11:20 vuln.today

CVE Published

Aug 09, 2026 - 10:30 cve.org

CRITICAL 9.3

DescriptionCVE.org

A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) enables unauthenticated network-adjacent attackers to execute arbitrary OS commands by manipulating the enable, name, or mac parameters of the MAC address filter configuration CGI endpoint. The vulnerable sprintf call in the protocol.csp handler passes user-supplied input directly into a shell command string without sanitization. A public proof-of-concept exploit has been published on GitHub, significantly lowering the exploitation barrier, though no CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected product is identified by CPE cpe:2.3:a:shenzhen_aitemi:m300_wi-fi_repeater:*:*:*:*:*:*:*:*, covering all known versions of the Shenzhen Aitemi M300 Wi-Fi Repeater. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), a classic embedded firmware pattern where a C-level sprintf call constructs a shell command string by concatenating user-controlled HTTP parameters - enable, name, and mac - without escaping shell metacharacters. The vulnerable CGI endpoint is /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add, which handles the addition of MAC address filter entries. This pattern is prevalent in SOHO router and repeater firmware where web-to-shell bridges are implemented without input validation, and the injected commands execute with whatever privileges the CGI process runs under - typically root on embedded Linux.

RemediationAI

No vendor-released patch has been identified at time of analysis. The immediate priority is to restrict access to the device's web management interface: place the repeater behind a firewall and apply ACLs blocking access to the /protocol.csp endpoint and the management port (typically TCP 80/8080) from all untrusted network segments, including the WAN interface if applicable - this eliminates remote exploitation but does not address LAN-side attackers. If the management interface cannot be isolated, consider disabling the MAC address filtering feature entirely if it is not operationally required, which removes the specific vulnerable code path (trade-off: loss of MAC filter functionality). Device replacement with a supported product from a vendor with an active security response program should be evaluated, given the absence of any vendor advisory or patch commitment. Monitor https://vuldb.com/vuln/387184 for patch availability updates.