M300 Wi-Fi Repeater CVE-2026-58457

Exploitation requires network adjacency to the device - the attacker must be able to reach the M300's web backend, typically by being connected to or in range of the repeater's LAN/Wi-Fi (the description states 'network-adjacent,' which limits exploitation despite the input vector's AV:N). No authentication is required (PR:N) and no user interaction is needed (UI:N). The concrete prerequisite is the ability to send an HTTP GET request to the smacfilter_conf handler in the commuos backend with a semicolon-delimited payload in the name, enable, or mac parameter; the smacfilter (MAC filter) configuration feature must be reachable. Limiting factors: the attacker needs LAN/adjacent-network reach rather than arbitrary internet routing, and the target must be the M300 running the vulnerable MT02 firmware.

The signals mostly align toward high technical severity but limited real-world blast radius. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) indicates trivial, unauthenticated, no-interaction exploitation with full confidentiality/integrity/availability impact, and public POC code raises the practical exploitability. However, the description explicitly characterizes the threat as 'network-adjacent,' which conflicts with the AV:N (network) metric in the input vector - a genuine adjacency-vs-network discrepancy that materially changes reachability, since an attacker generally must be on the same LAN/Wi-Fi segment rather than exploiting across the internet. This should be verified against the VulnCheck advisory. No EPSS score was provided, and the CVE is not in CISA KEV, so there is no evidence of mass or automated exploitation despite the available POC. Net assessment: a genuinely dangerous, easy-to-exploit root-takeover bug, but the affected product is an obscure consumer repeater and exploitation almost certainly requires network adjacency, making it a targeted/local risk rather than an internet-wide emergency.

An attacker who has joined or is adjacent to the same Wi-Fi/LAN as the repeater sends a crafted HTTP GET request to the smacfilter_conf endpoint, appending a semicolon-delimited shell payload (e.g., in the mac parameter) such as a reverse-shell or telnetd command. Because the input flows unsanitized through sprintf() into a root-level doSystemCmdComlib() call, the injected command runs as root, giving full device control. Public POC code (IEATASICS/m300-repeater-bugs) lowers the skill required and demonstrates the technique.