CVE-2026-19348 in M300 Wi-Fi Repeater
Summary
by MITRE • 08/09/2026
A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The Shenzhen Aitemi M300 Wi-Fi Repeater model r0-ea7890a presents a critical command injection vulnerability within its web interface implementation. This flaw exists in the sprintf function located within the /protocol.csp file, specifically when processing parameters through the net protocol endpoint with smacfilter_conf configuration options. The vulnerability manifests when attacker-controlled inputs are processed through the enable/name/mac arguments without proper sanitization or validation mechanisms.
The technical exploitation occurs through manipulation of the command injection vector within the web application's parameter handling logic. When the sprintf function processes user-supplied data from the net protocol endpoint, it fails to properly escape or validate input parameters that are subsequently used in system commands. This creates an environment where maliciously crafted inputs can be interpreted as shell commands rather than benign data, allowing remote attackers to execute arbitrary code on the device with the privileges of the web server process.
The operational impact of this vulnerability extends beyond simple command execution capabilities, as it enables full compromise of the affected device through remote exploitation. Attackers can leverage this weakness to gain persistent access to the network infrastructure, potentially using the device as a pivot point for further attacks within the local network. The vulnerability's accessibility via remote web interface access means that attackers do not require physical proximity or network-level privileges to exploit the flaw, making it particularly dangerous for enterprise and home network deployments.
This vulnerability aligns with CWE-78 and CWE-89 categories related to improper neutralization of special elements used in OS commands and SQL injection respectively, while also mapping to ATT&CK technique T1059.001 for command and scripting interpreter. The public availability of exploit code significantly increases the risk profile, as it removes the barrier to entry for potential attackers who may not possess advanced exploitation capabilities. Organizations deploying these devices should immediately implement network segmentation measures and consider disabling unnecessary web interfaces until vendor patches are available.
The root cause stems from insufficient input validation and improper output escaping within the web application's configuration handling routines. The sprintf function call does not incorporate proper sanitization of user-supplied parameters before incorporating them into system command contexts, creating a direct path for malicious input to be executed as shell commands. This represents a classic buffer overflow and command injection vulnerability pattern commonly found in embedded web applications that fail to properly implement secure coding practices.
Mitigation strategies should include immediate firmware updates from the vendor if available, network-level firewall rules blocking access to the affected web interface, and implementation of intrusion detection systems monitoring for exploitation attempts. Network administrators should also consider disabling unused protocols and services, implementing strong authentication mechanisms, and regularly auditing device configurations for potential security misconfigurations that could compound the impact of this vulnerability.