What is CVE-2025-34151?

CVE-2025-34151 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-07.

Is CVE-2025-34151 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater

CVE-2025-34151

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code execution.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.037 (88.9th percentile) — read the EPSS interpretation.

Affected products

Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-fi Repeater

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-34151?: CVE-2025-34151 is a vulnerability in Shenzhen Aitemi E Commerce Co. Ltd. M300 Wi-Fi Repeater, classified under OS Command Injection. Published 2025-08-07.
Is CVE-2025-34151 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.