Paper/Archive/CVE-2025-34150

CVE-2025-34150

Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater — Shenzhen Aitemi M300 Wi-Fi Repeater PPPoE Username Command Injection

EPSS 1%public exploit CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 68.5.685 × 2013.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter. Input is processed unsafely during network setup, allowing attackers to execute arbitrary system commands with root privileges.

Affected

ProductAffectedFixed inSource

M300 Wi-Fi Repeaterall versions–CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitchocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two refaliexpress.us/item/3256806767641280.html writeupvulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-username-command-injection