PT-2025-32274 · Aitemi · Aitemi M300 Wi-Fi Repeater

Jared Brits + 2 · Published 2025-08-07 · Updated 2025-08-10 · CVE-2025-34149

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) (affected versions not specified)

Description A command injection vulnerability exists during WPA2 configuration. The key parameter is directly interpreted by the system shell, allowing attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34149

Affected Products

Aitemi M300 Wi-Fi Repeater

References · 9

• 🔥 https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34149 · Security Note
• https://twitter.com/CveFindCom/status/1953504234973831403 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953541947315966129 · Twitter Post
• https://twitter.com/offseq/status/1953720463256924592 · Twitter Post
• https://twitter.com/SecAideInfo/status/1954486768637505765 · Twitter Post
• https://twitter.com/CVEnew/status/1953506239939231845 · Twitter Post
• https://aliexpress.us/item/3256806767641280.html · Note
• https://vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-wpa2-key · Note