Remote Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater

A critical command injection vulnerability (CVE-2026-19348) has been identified in the Shenzhen Aitemi M300 Wi-Fi Repeater, specifically affecting firmware version r0-ea7890a. The vulnerability originates from the unsafe use of the 'sprintf' function within the '/protocol.csp' handler. An unauthenticated, remote attacker can manipulate the 'enable', 'name', or 'mac' parameters to inject and execute arbitrary commands on the underlying operating system. Because public exploit code is available, this vulnerability poses a significant risk to organizations using these devices in their network infrastructure. Defenders should restrict access to the management interface of affected devices and monitor for suspicious HTTP traffic directed at the '/protocol.csp' URI.

Impact

Successful exploitation allows unauthenticated remote code execution with the privileges of the web service. This could result in full device compromise, persistence, or use of the device as a pivot point for further lateral movement within the local network. Given that this is a Wi-Fi repeater, compromise provides an attacker with a strategic vantage point to intercept or manipulate local wireless traffic.

Recommendation

• Identify and inventory all Shenzhen Aitemi M300 Wi-Fi Repeaters on the network.
• Implement network-level access controls (ACLs) to restrict access to the management interface of the M300 devices to trusted administrative IP addresses only.
• Monitor network traffic for HTTP POST or GET requests to '/protocol.csp' containing shell metacharacters (e.g., ;, |, &, $, `) in the 'enable', 'name', or 'mac' parameters.
• Contact the vendor, Shenzhen Aitemi, for firmware updates that address the unsafe usage of 'sprintf' in the protocol handler.