An unauthenticated remote command injection flaw in the Shenzhen Aitemi M300 Wi-Fi Repeater, rated CVSS 9.8 CRITICAL, is reported to have publicly available exploit code.
What Is It
CVE-2026-19348 is a command injection vulnerability (CWE-74 / CWE-77) in the Shenzhen Aitemi M300 Wi-Fi Repeater, firmware r0-ea7890a. The flaw sits in the sprintf function handling the endpoint /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Manipulating the enable, name, or mac arguments results in command injection.
The attack can be initiated remotely. Per the NVD record, the exploit has been disclosed publicly and may be used for attacks.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base score 9.8, CRITICAL. Every exploitability condition favors the attacker: network attack vector, low complexity, no privileges required, and no user interaction. Impact is HIGH across confidentiality, integrity, and availability.
The CVSS 4.0 assessment from the CNA scores it 8.9 HIGH with an exploit maturity of PROOF_OF_CONCEPT, and the legacy CVSS 2.0 score is a flat 10.0. If the reported proof-of-concept is functional, the combination of public exploit code and zero authentication requirement on a consumer networking device would make this a low-effort target for opportunistic scanning.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed by KEV at this time. The claim of public exploit availability rests on the NVD/VulDB record; the supplied source material does not independently verify that working exploit code is in circulation.
What's Vulnerable
- Vendor: Shenzhen Aitemi
- Product: M300 Wi-Fi Repeater
- Affected version:
r0-ea7890a - CPE:
cpe:2.3:a:shenzhen_aitemi:m300_wi-fi_repeater:*:*:*:*:*:*:*:*
Patch Status
The supplied NVD record does not list a vendor patch, fixed version, or advisory. NVD status is Received (published 2026-08-09, assigned by [email protected]), meaning the record has not yet completed analysis. No CISA KEV entry is present, so no KEV-mandated remediation deadline or required action applies.
With no documented fix, the only supported guidance from this source material is that the affected firmware version remains vulnerable.
Sources
- NVD, CVE-2026-19348: https://nvd.nist.gov/vuln/detail/CVE-2026-19348
- VulDB, CVE-2026-19348: https://vuldb.com/cve/CVE-2026-19348
- VulDB, Entry 387184: https://vuldb.com/vuln/387184
- VulDB, Entry 387184 CTI: https://vuldb.com/vuln/387184/cti
- GitHub; IEATASICS/m300-repeater-bugs: https://github.com/IEATASICS/m300-repeater-bugs