PT-2025-32275 · Aitemi · Aitemi M300 Wi-Fi Repeater

Jared Brits + 2 · Published 2025-08-07 · Updated 2025-08-10 · CVE-2025-34150

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) (affected versions not specified)

Description The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater is vulnerable to command injection via the user parameter. Input is processed unsafely during network setup, allowing attackers to execute arbitrary system commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-34150

Affected Products

Aitemi M300 Wi-Fi Repeater

References · 8

• 🔥 https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-34150 · Security Note
• https://twitter.com/CVEnew/status/1953506240874578181 · Twitter Post
• https://twitter.com/CveFindCom/status/1953504176018715086 · Twitter Post
• https://twitter.com/offseq/status/1953743137576275994 · Twitter Post
• https://aliexpress.us/item/3256806767641280.html · Note
• https://twitter.com/VulmonFeeds/status/1953547066300330176 · Twitter Post
• https://twitter.com/SecAideInfo/status/1954486758646632559 · Twitter Post