What is CVE-2025-34149?

CVE-2025-34149 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-07.

Is CVE-2025-34149 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater

CVE-2025-34149

A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is interpreted directly by the system shell, enabling attackers to execute arbitrary commands as root. Exploitation requires no authentication and can be triggered during wireless setup.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.014 (70.8th percentile) — read the EPSS interpretation.

Affected products

Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-fi Repeater

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-34149?: CVE-2025-34149 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-07.
Is CVE-2025-34149 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.