CVE-2025-34151 - Shenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command Injection

Back Back to CVE browser

CRITICAL

Shenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command Injection

Published Aug 7, 2025

9.4

CRITICAL

CVSS 4.0

EPSS 3.73%

Description

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code execution.

Affected products

Vendor Shenzhen Aitemi E Commerce Co. Ltd. Product M300 Wi-Fi Repeater Default
unaffected

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Shenzhen Aitemi E Commerce Co. Ltd.

M300 Wi-Fi Repeater

unaffected

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/
technical-descriptionexploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23926
Advisory
https://www.aliexpress.us/item/3256806767641280.html
product
https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-password-command-injection
third-party-advisory

Link	Providers	Tags
https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/		technical-descriptionexploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23926		Advisory
https://www.aliexpress.us/item/3256806767641280.html		product
https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-password-command-injection		third-party-advisory