Loading vulnerability…
CVE-2025-34152 is an unauthenticated operating system command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater, hardware model MT02. The flaw is exposed through the 'time' parameter of the '/protocol.csp?' endpoint. Supplied input is passed to the device's internal date-setting functionality and processed by the underlying date '-s' command without sufficient sanitization or neutralization of shell metacharacters, allowing attacker-controlled command execution on the device. The vulnerable behavior reportedly does not require a reboot and does not interrupt the HTTP service, and this injection point is notable because exploitation can occur without causing obvious configuration changes visible to an administrator. The issue affects an internet-reachable embedded Linux device class that has been observed in botnet exploitation activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a working exploit for CVE-2025-34152, targeting the Shenzhen Aitemi M300 Wi-Fi Repeater. The exploit is implemented in Go (CVE-2025-34152.go) and enables unauthenticated remote code execution by sending a crafted POST request to the device's /protocol.csp endpoint. The payload establishes a reverse shell from the device to the attacker's machine using netcat and a named pipe. The exploit does not require authentication, does not reboot the device, and is suitable for automated exploitation. The README provides version information, remediation advice, and usage instructions. The repository is structured simply, with the main exploit code, a README, and a license file. No detection scripts or fake code are present; this is a functional exploit.
This repository contains a single Metasploit module (aitemi_m300_time_rce.rb) targeting an unauthenticated remote command injection vulnerability (CVE-2025-34152) in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The exploit leverages the 'time' parameter in the time configuration endpoint, which is unsafely passed to a shell command executed as root. The module provides both detection (via favicon hash, HTTP server version, and HTML content) and exploitation capabilities. The attacker can inject arbitrary shell commands, with default payloads including a reverse shell or Meterpreter for MIPSBE architecture. No authentication is required, and exploitation does not require a device reboot or network reconfiguration. The code is written in Ruby and is fully integrated into the Metasploit framework, allowing for payload customization and automated exploitation.
This repository contains a single Go exploit targeting CVE-2025-34152, an unauthenticated remote code execution vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater. The exploit does not require authentication and is designed for automated exploitation at scale. It sends a crafted POST request to the /protocol.csp endpoint on the target device, injecting a shell command that establishes a reverse shell to the attacker's machine using netcat and a named pipe. The exploit is operational, requiring the attacker to specify the target URL, their own IP, and a listening port. The code also supports optional proxying of requests. The repository is well-structured, with clear usage instructions and comments, and is focused solely on exploitation (not detection or scanning).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Shenzhen Aitemi M300 Wi-Fi Repeater vulnerability actively exploited in July 2026 and explicitly linked to Dysphoria botnet exploitation of embedded devices.
A recently exploited vulnerability used by the Dysphoria botnet for propagation to compromise internet-exposed devices.
A recently disclosed vulnerability listed as exploited by the Dysphoria botnet for propagation into IoT devices.
A vulnerability exploited by the Dysphoria botnet to compromise devices.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.