RCE in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater
CVE-2025-34149
A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.014 (72.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 72nd percentile — 72.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/ (technical-description, exploit)
- www.aliexpress.us/item/3256806767641280.html (product)
- www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-inje… (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34149?
- CVE-2025-34149 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-07.
- Is CVE-2025-34149 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.