CVE-2026-58457 CRITICAL

CVE-2026-58457: Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

Vendor Shenzhen Aitemi E Commerce Co. Ltd.
Product M300 Wi-Fi Repeater
Weakness CWE-78
Published July 1, 2026
Last update July 1, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passed without sanitization into sprintf() to build uci shell commands executed via doSystemCmdComlib(), granting full root-level control of the device.

Key dates

02Disclosure timeline

July 1, 2026 CVE published
July 1, 2026 Record updated