CVE-2026-58457
Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passed without sanitization into sprintf() to build uci shell commands executed via doSystemCmdComlib(), granting full root-level control of the device.
| CWE | CWE-78 |
| Vendor | shenzhen aitemi e commerce co. ltd. |
| Product | m300 wi-fi repeater |
| Published | Jul 1, 2026 |
| Last Updated | Jul 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for shenzhen aitemi e commerce co. ltd. m300 wi-fi repeater
Be the first to know when new critical vulnerabilities affecting shenzhen aitemi e commerce co. ltd. m300 wi-fi repeater are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Shenzhen Aitemi E Commerce Co. Ltd. / M300 Wi-Fi Repeater
*
References
Credits
Conrad Franke