M300 Wi Fi Repeater
Monthly
Remote command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) enables unauthenticated network-adjacent attackers to execute arbitrary OS commands by manipulating the enable, name, or mac parameters of the MAC address filter configuration CGI endpoint. The vulnerable sprintf call in the protocol.csp handler passes user-supplied input directly into a shell command string without sanitization. A public proof-of-concept exploit has been published on GitHub, significantly lowering the exploitation barrier, though no CISA KEV listing has been identified at time of analysis.
Unauthenticated OS command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) lets network-adjacent attackers run arbitrary shell commands as root through the smacfilter_conf handler in the commuos web backend. Publicly available exploit code exists (published by VulnCheck/IEATASICS), and successful exploitation grants full device takeover; the flaw carries a CVSS 4.0 base score of 9.3 but is reachable only by attackers adjacent to the device's network. No public exploit is listed in CISA KEV, so this is proof-of-concept exposure rather than confirmed active exploitation.
Remote command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) enables unauthenticated network-adjacent attackers to execute arbitrary OS commands by manipulating the enable, name, or mac parameters of the MAC address filter configuration CGI endpoint. The vulnerable sprintf call in the protocol.csp handler passes user-supplied input directly into a shell command string without sanitization. A public proof-of-concept exploit has been published on GitHub, significantly lowering the exploitation barrier, though no CISA KEV listing has been identified at time of analysis.
Unauthenticated OS command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) lets network-adjacent attackers run arbitrary shell commands as root through the smacfilter_conf handler in the commuos web backend. Publicly available exploit code exists (published by VulnCheck/IEATASICS), and successful exploitation grants full device takeover; the flaw carries a CVSS 4.0 base score of 9.3 but is reachable only by attackers adjacent to the device's network. No public exploit is listed in CISA KEV, so this is proof-of-concept exposure rather than confirmed active exploitation.