What is CVE-2025-34147?

CVE-2025-34147 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-04.

Is CVE-2025-34147 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater

CVE-2025-34147

An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in Extender mode via its captive portal, the extap2g SSID field is inserted unescaped into a reboot-time shell script. This allows remote attackers within Wi-Fi range to inject arbitrary shell commands that execute as root during device reboot, leading to full system compromise.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.011 (62.4th percentile) — read the EPSS interpretation.

Affected products

Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-fi Repeater

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-34147?: CVE-2025-34147 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-04.
Is CVE-2025-34147 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.