Vulnerability · Published Aug 7, 2025 · Assigned by VulnCheck

CVE-2025-34149Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WPA2 Key

Critical 9.4

In plain English

A critical-severity OS command injection in M300 Wi-Fi Repeater from Shenzhen Aitemi E Commerce Co. Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.3%top 29.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.

Affected products (as reported)

Vendor	Product	Versions
Shenzhen Aitemi E Commerce Co. Ltd.	M300 Wi-Fi Repeater	*

Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/ technical-description, exploit
https://www.aliexpress.us/item/3256806767641280.html product
https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-wpa2-key third-party-advisory