Which versions of M300 Wi-Fi Repeater are affected by CVE-2026-58457?

The Shenzhen Aitemi M300 Wi-Fi Repeater contains a critical unauthenticated remote code execution vulnerability allowing attackers to assume full device control without authentication.

Is there a public PoC exploit available for CVE-2026-58457?

Yes, a public proof-of-concept exploit is available for CVE-2026-58457. Prioritise patching immediately. EPSS: 1.7%.

How to fix or mitigate CVE-2026-58457?

Within 24 hours: Inventory all Aitemi M300 MT02 units in your environment and immediately isolate them from production networks or restrict administrative access to locked-down management VLANs only. Within 7 days: Implement compensating controls including network segmentation, disable remote management features, and deploy monitoring on these devices for exploitation attempts. Within 30 days: Execute device replacement strategy with alternative Wi-Fi repeater products and retire all M300 MT02 units from service.

M300 Wi-Fi Repeater CVE-2026-58457

Q: What is the CVSS score of CVE-2026-58457?

CVE-2026-58457 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.7%.

EUVD-2026-41128 CRITICAL

OS Command Injection (CWE-78)

2026-07-01 VulnCheck

GHSA-gfhx-3hfg-x9hv

Command Injection M300 Wi Fi Repeater

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Description says 'network-adjacent,' so AV:A rather than AV:N; unauthenticated (PR:N) with no interaction, and root command execution yields full C:H/I:H/A:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 20:15 vuln.today

CVE Published

Jul 01, 2026 - 19:22 cve.org

CRITICAL 9.3

DescriptionCVE.org

Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passed without sanitization into sprintf() to build uci shell commands executed via doSystemCmdComlib(), granting full root-level control of the device.

Articles & Coverage 1

POC CVE-2026-58457: Unauthenticated OS Command Injection Achieves Remote Root on Shenzhen Aitemi M300 Wi-Fi Repeater Jul 16, 2026

AnalysisAI

Unauthenticated OS command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) lets network-adjacent attackers run arbitrary shell commands as root through the smacfilter_conf handler in the commuos web backend. Publicly available exploit code exists (published by VulnCheck/IEATASICS), and successful exploitation grants full device takeover; the flaw carries a CVSS 4.0 base score of 9.3 but is reachable only by attackers adjacent to the device's network. No public exploit is listed in CISA KEV, so this is proof-of-concept exposure rather than confirmed active exploitation.

Technical ContextAI

The vulnerability is a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw in the device firmware's web configuration backend, internally named 'commuos'. The smacfilter_conf handler (a MAC-address filtering configuration feature) reads the GET parameters name, enable, and mac and passes them directly into sprintf() to assemble a UCI (Unified Configuration Interface, the OpenWrt-style config system common on embedded Linux routers/repeaters) shell command. That command string is then executed with doSystemCmdComlib(), a system()-style wrapper running with root privileges. Because no input sanitization, escaping, or allowlisting occurs before the string reaches the shell, semicolon-delimited command separators in the attacker-supplied values are interpreted as additional shell commands. The affected product per CPE is cpe:2.3:a:shenzhen_aitemi_e_commerce_co._ltd.:m300_wi-fi_repeater, a low-cost consumer Wi-Fi range extender.

RemediationAI

No vendor-released patch identified at time of analysis, and the CPE shows all versions affected, so remediation must rely on compensating controls. Because exploitation targets the device's web backend (smacfilter_conf handler in commuos), restrict management-interface access: place the repeater on an isolated VLAN/SSID that untrusted clients cannot reach, disable or firewall the HTTP administration interface from general client traffic, and change/enforce network access controls so only trusted administrative hosts can reach the device's web server - trade-off is loss of convenient in-network configuration. Given that a root compromise is possible and no firmware fix exists, the most reliable control is to retire or replace the device in security-sensitive environments; if it must remain, monitor its LAN segment for anomalous outbound traffic that could indicate compromise. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-mt02-unauthenticated-os-command-injection-via-protocol-csp) for any updated vendor guidance.