Loading vulnerability…
Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater
CVE-2025-34152 is an unauthenticated operating system command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater, hardware model MT02. The flaw is exposed through the 'time' parameter of the '/protocol.csp?' endpoint. Supplied input is passed to the device's internal date-setting functionality and processed by the underlying date '-s' command without sufficient sanitization or neutralization of shell metacharacters, allowing attacker-controlled command execution on the device. The vulnerable behavior reportedly does not require a reboot and does not interrupt the HTTP service, and this injection point is notable because exploitation can occur without causing obvious configuration changes visible to an administrator. The issue affects an internet-reachable embedded Linux device class that has been observed in botnet exploitation activity.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary OS commands on the affected repeater. This can result in full compromise of the device, including takeover of the management plane, modification of system state, deployment of malware or botnet payloads, use of the device for distributed denial-of-service activity or traffic relay, and potential abuse of the device as a foothold within the local network. Because exploitation does not require service disruption or visible configuration changes, compromise may be comparatively stealthy and persist without immediate operator awareness.
If you can’t patch tonight, do this now.
Until remediation is available, restrict access to the device management interface so the vulnerable endpoint is not reachable from untrusted networks, especially the public internet. Limit administrative access to trusted management hosts or isolated management networks, disable remote administration if not operationally required, and place the device behind firewall rules that block unsolicited access to its web interface. Monitor for signs of exploitation or unexpected process activity on exposed embedded devices and consider removing or replacing internet-exposed units that cannot be adequately segmented.
Patch, then assume compromise.
Apply the vendor-provided fix or updated firmware for the Shenzhen Aitemi M300 Wi-Fi Repeater if one is available. If no official patch information is currently available, replace affected devices with supported firmware or hardware that corrects the command injection flaw. Validate after update that the vulnerable endpoint no longer passes unsanitized input from the 'time' parameter into system command execution paths.
3 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.