CVE-2025-34152criticalobserved exploitationCWE-78

CVE-2025-34152: critical vulnerability in Shenzhen Aitemi E Commerce Co. Ltd.

Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter

Published · Updated

Follow this CVE+ Monitor M300 Wi-Fi Repeater

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.4epss 84%
from disclosure to weaponsame day
Published on NVDAug 7
1st PoCAug 7
metasploitAug 7
VulnCheck+39d
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Shenzhen Aitemi E Commerce Co. Ltd. · M300 Wi-Fi Repeater
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Shenzhen Aitemi E Commerce Co. Ltd.

In the same product, most dangerous first.

CVE-2025-34151CRITICALShenzhen Aitemi M300 Wi-Fi Repeater PPPoE Password Command InjectionEPSS 3.3%CVE-2026-58457CRITICALShenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspEPSS 2.9%CVE-2025-34149CRITICALShenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WPA2 KeyEPSS 1.2%CVE-2025-34150CRITICALShenzhen Aitemi M300 Wi-Fi Repeater PPPoE Username Command InjectionEPSS 1.1%CVE-2025-34148CRITICALShenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WISP SSIDEPSS 1.1%CVE-2025-34147CRITICALShenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via SSIDEPSS 0.9%