Executive Summary
A critical unauthenticated command injection vulnerability has been discovered in the Shenzhen Aitemi M300 Wi-Fi Repeater, a widely used consumer and small-business networking device. Tracked as CVE-2026-19348 with a CVSS score of 9.8 (Critical), the flaw allows a remote, unauthenticated attacker to inject arbitrary OS commands through the device's MAC filter configuration endpoint.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-19348 |
| CVSS Score | 9.8 (Critical) |
| Type | Command Injection |
| Attack Vector | Network |
| Authentication | None required |
| Affected Firmware | r0-ea7890a |
Vulnerability Details
The vulnerability resides in the sprintf function call within the file handler for the endpoint:
/protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1
The enable, name, and mac parameters are passed to a sprintf format string without sanitization. An attacker can manipulate any of these parameters to inject shell metacharacters, resulting in arbitrary OS command execution on the underlying Linux-based firmware.
Root Cause
The device's web management interface processes user-supplied input directly in a C-style sprintf call, concatenating values into a shell command string. No input validation or escaping is applied before the command is executed by the underlying OS.
Attack Scenario
An attacker on the same local network — or on the internet if the management interface is internet-exposed — can send a crafted HTTP request to the MAC filter endpoint. By injecting shell command syntax (e.g., ;cmd# or $(cmd)) into any of the three vulnerable parameters, the attacker gains remote code execution as root on the device.
Affected Versions
| Device | Firmware Version |
|---|---|
| Shenzhen Aitemi M300 Wi-Fi Repeater | r0-ea7890a |
No patch has been issued by the vendor at time of publication. Other firmware versions may also be affected.
Impact
Successful exploitation of CVE-2026-19348 allows an attacker to:
- Execute arbitrary commands with root-level privileges on the device
- Pivot into the local network using the repeater as a foothold
- Intercept traffic flowing through the device (man-in-the-middle)
- Install persistent backdoors on the firmware
- Enumerate and attack other devices on the local network segment
IoT devices like Wi-Fi repeaters are frequently overlooked in patch management cycles, making them attractive long-term persistence points for attackers.
Remediation
Immediate Mitigations
Since no vendor patch is available, apply the following compensating controls:
- Restrict management interface access — Block access to the device's web interface from the internet using firewall rules.
- Isolate the device — Place Wi-Fi repeaters on a dedicated VLAN or isolated network segment to limit lateral movement potential.
- Disable remote management — If the device supports it, disable remote (WAN-side) access to the management interface.
- Monitor for unusual traffic — Watch for unexpected outbound connections or anomalous HTTP requests originating from the device.
- Consider replacement — For environments where security is a priority, replace the M300 with a device from a vendor with an active security advisory program.
Long-Term
- Contact Shenzhen Aitemi for vendor patch status
- Subscribe to the NVD feed or device vendor alerts for firmware updates
- Apply firmware updates immediately when released
IoT Security Context
Consumer-grade networking equipment — particularly Wi-Fi repeaters, range extenders, and SOHO routers — frequently suffers from command injection vulnerabilities due to:
- Minimal development resources — Budget hardware manufacturers often lack dedicated security teams
- Legacy C codebases — Firmware based on outdated code with no modern mitigations (ASLR, stack canaries)
- Infrequent patching — Vendors may not maintain long-term patch support for low-cost devices
- Extended deployment lifetimes — Devices remain in service for years without updates
CVE-2026-19348 fits this pattern precisely. With a CVSS score of 9.8, it represents one of the most severe classes of vulnerability: network-accessible, unauthenticated, and trivially exploitable.