RCE in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater
CVE-2025-34150
The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter. Input is processed unsafely during network setup, allowing attackers to execute arbitrary system commands with root privileges.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.014 (70.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 70.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/ (technical-description, exploit)
- www.aliexpress.us/item/3256806767641280.html (product)
- www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-pppoe-username-… (third-party-advisory)
Frequently asked questions
- What is CVE-2025-34150?
- CVE-2025-34150 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-07.
- Is CVE-2025-34150 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.