Description

A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-09T11:16:52.743Z",
  "pubdate": "2026-08-09T11:16:52.743Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. The flaw resides within the handling of specific HTTP GET parameters processed by the underlying firmware binary. Specifically, improper input sanitization and unsafe utilization of the sprintf function within the routing and configuration logic allow an unauthenticated remote attacker to inject arbitrary operating system commands.\nThe vulnerability affects the endpoint /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1, where manipulation of parameters such as enable, name, or mac directly leads to code execution in the context of the device's administrative or root user. Given that a public exploit has been released, threat actors can leverage this flaw to fully compromise vulnerable network devices remotely over the network without requiring prior authentication.\nSuccessful exploitation results in complete system compromise, allowing attackers to execute arbitrary commands, alter device configurations, manipulate network traffic, or pivot deeper into internal network segments. Organizations utilizing the affected Shenzhen Aitemi M300 Wi-Fi Repeater face severe risk until appropriate firmware updates or network-level mitigations are applied.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw stemming from insufficient validation and sanitization of user-supplied input parameters passed to the firmware's internal backend logic. The affected component is associated with the function sprintf implemented within the processing routines for the URL path /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1.\nDuring normal operation, the web application interface parses query string parameters corresponding to MAC address filtering configurations, including name, enable, and mac arguments. These parameters are improperly concatenated or formatted using unsafe C-style string formatting functions such as sprintf into an internal system command buffer without adequate escaping or boundary checks.\nAn attacker can exploit this behavior by supplying specially crafted shell metacharacters (such as semicolons, pipe symbols, or backticks) combined with arbitrary system commands within the vulnerable parameters (enable, name, or mac). When the binary executes the formatted string via system-level execution functions, the underlying operating system shell interprets and executes the injected payload.\nThe attack flow proceeds as follows: 1) The remote attacker crafts an HTTP request targeting the vulnerable /protocol.csp endpoint with malicious shell commands embedded in the configuration parameters. 2) The embedded web server parses the query parameters and passes them to the vulnerable internal function. 3) The sprintf function constructs a system command string containing the unvalidated user input. 4) The application executes the constructed command via the underlying OS shell. 5) The injected payload executes with elevated privileges, granting the attacker full control over the device.\nThe vulnerability affects Shenzhen Aitemi M300 Wi-Fi Repeater version r0-ea7890a. Exploitation can be initiated remotely over the network, and the availability of a public exploit significantly lowers the threshold for automated attacks by malicious actors."
}