CVE-2025-34149 CRITICAL

CVE-2025-34149: Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via WPA2 Key

Vendor Shenzhen Aitemi E Commerce Co. Ltd.
Product M300 Wi-Fi Repeater
Weakness CWE-78
Published August 7, 2025
Last update December 1, 2025
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.

Key dates

02Disclosure timeline

August 7, 2025 CVE published
December 1, 2025 Record updated