EUVD-2026-54917
GHSA-5x4f-6m9q-mg75
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach M300 management HTTP interface
-
DeliverySend crafted GET/POST to /protocol.csp with injected shell metacharacters
-
Exploitsprintf constructs malicious command string
-
ExecutionEmbedded OS executes injected command as privileged process
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the CVSS 4.0 PR:N metric confirms the vulnerable endpoint does not enforce access controls. The attacker must have HTTP connectivity to the device's web management interface, which in typical SOHO deployments is accessible on the LAN segment. Internet-exposed management interfaces (common on misconfigured repeaters or those with WAN-side HTTP enabled) expand the attacker population to the full internet. No special configuration, feature flag, or specific firmware mode is required beyond the device running the affected firmware and the management interface being reachable. Exploitation is limited by: (1) network reachability to the management port, and (2) the relatively niche deployment footprint of the M300 device itself. |
| Impact | The CVSS 4.0 base score of 8.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H accurately captures the severity: unauthenticated, zero-complexity, remote exploitation yielding full device compromise. The E:P modifier (proof-of-concept public) in the CVSS 4.0 environmental data is consistent with the GitHub exploit repository, and materially increases near-term exploitation probability. No EPSS score was provided in the intelligence data - this is a gap; without it, probabilistic prioritization against other CVEs is not possible from the available data. The device's SOHO deployment profile limits blast radius compared to enterprise infrastructure CVEs, but internet-exposed management interfaces on home or branch-office repeaters are routinely targeted by botnets and mass-scanning campaigns. The absence of a vendor patch and the public exploit together make this a high-urgency item for any network where M300 units are deployed with reachable management interfaces. |
| Exploit ScenarioDerived | An unauthenticated attacker reachable to the M300's web management interface sends a crafted HTTP request to /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test%3Bwhoami&enable=1&mac=00:00:00:00:00:00, injecting a shell command via the name parameter. The firmware's sprintf call constructs a command string incorporating the unsanitized semicolon-delimited payload, which the underlying OS executes. A public proof-of-concept at https://github.com/IEATASICS/m300-repeater-bugs is available, meaning this attack requires minimal technical skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 09, 2026
Remote command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) enables unauthenticated network-adjacent attackers to execute arbitrary OS commands by manipulating the enable, name, or mac parameters of the MAC address filter configuration CGI endpoint. The vulnerable sprintf call in the protocol.csp handler passes user-supplied input directly into a shell command string without sanitization. A public proof-of-concept exploit has been published on GitHub, significantly lowering the exploitation barrier, though no CISA KEV listing has been identified at time of analysis.
Earlier versions of this analysis (1)
Command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) lets remote attackers run arbitrary OS commands by manipulating the enable, name, or mac parameters of the smacfilter_conf 'add' action in the /protocol.csp web endpoint. The flaw stems from unsanitized input passed to a sprintf-built command string; exploit code is publicly available, and CVSS 4.0 scores it 9.3 (Critical) with no authentication or user interaction required.
RemediationAI
No vendor-released patch has been identified at time of analysis. The immediate priority is to restrict access to the device's web management interface: place the repeater behind a firewall and apply ACLs blocking access to the /protocol.csp endpoint and the management port (typically TCP 80/8080) from all untrusted network segments, including the WAN interface if applicable - this eliminates remote exploitation but does not address LAN-side attackers. If the management interface cannot be isolated, consider disabling the MAC address filtering feature entirely if it is not operationally required, which removes the specific vulnerable code path (trade-off: loss of MAC filter functionality). Device replacement with a supported product from a vendor with an active security response program should be evaluated, given the absence of any vendor advisory or patch commitment. Monitor https://vuldb.com/vuln/387184 for patch availability updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is identified by CPE cpe:2.3:a:shenzhen_aitemi:m300_wi-fi_repeater:*:*:*:*:*:*:*:*, covering all known versions of the Shenzhen Aitemi M300 Wi-Fi Repeater. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), a classic embedded firmware pattern where a C-level sprintf call constructs a shell command string by concatenating user-controlled HTTP parameters - enable, name, and mac - without escaping shell metacharacters. The vulnerable CGI endpoint is /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add, which handles the addition of MAC address filter entries. This pattern is prevalent in SOHO router and repeater firmware where web-to-shell bridges are implemented without input validation, and the injected commands execute with whatever privileges the CGI process runs under - typically root on embedded Linux.
Know when M300 Wi Fi Repeater gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable CGI endpoint with no authentication (consistent with CVSS 4.0 PR:N), no complexity barriers, and full device compromise with no scope change beyond the affected repeater.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) contains a critical remote command injection vulnerability (CVE-2026-19348) allowing unauthenticated attackers to execute arbitrary OS commands and gain complete device control. Publicly available exploit code exists, significantly lowering the technical barrier to attack, and no vendor patch is available. Organizations with deployed Aitemi M300 devices face immediate risk of network compromise and require urgent remediation.
No vendor-released patch identified at time of analysis. Isolate affected devices to segregated networks with restricted access; implement network segmentation limiting trust from these devices; deploy network-based monitoring for anomalous activity and command execution patterns; prioritize device replacement with vendors providing active security patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB