Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via SSID
Vulnerability Description
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in Extender mode via its captive portal, the extap2g SSID field is inserted unescaped into a reboot-time shell script. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root during device reboot, leading to full system compromise.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34147
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Valentin Lobstein (Chocapikk)
- Dinesh Aswin S. (esistdini)
References
More from Shenzhen Aitemi E Commerce Co. Ltd.
View All →Affected Vendor
Shenzhen Aitemi E Commerce Co. Ltd.
View all reports →