CVE-2026-19348: Aitemi M300 Wi-Fi Repeater RCE Vulnerability

CVE-2026-19348 Overview

CVE-2026-19348 is a command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater firmware r0-ea7890a. The flaw resides in the sprintf function handling requests to /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Attackers can manipulate the enable, name, or mac arguments to inject arbitrary operating system commands. The vulnerability is remotely exploitable without authentication or user interaction. A public exploit has been released, increasing the risk of active weaponization against exposed devices.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands on affected M300 Wi-Fi Repeaters, gaining full control of the device and any traffic it relays.

Affected Products

Shenzhen Aitemi M300 Wi-Fi Repeater firmware version r0-ea7890a
Devices exposing the /protocol.csp management endpoint
Deployments where the repeater management interface is reachable from untrusted networks

Discovery Timeline

2026-08-09 - CVE-2026-19348 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19348

Vulnerability Analysis

The vulnerability is a command injection flaw classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The affected component is the smacfilter configuration handler on the M300 Wi-Fi Repeater. When the device processes a request to /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add, it passes user-supplied values for enable, name, and mac into a sprintf call. That formatted string is then used to construct a shell command without sanitizing shell metacharacters. Successful exploitation yields command execution in the context of the web management process, which on embedded consumer routers typically runs as root. Attackers can pivot to persistent firmware modification, credential capture, or network-level man-in-the-middle attacks.

Root Cause

The root cause is unsafe string formatting combined with the absence of input validation. User-controlled parameters flow directly into a sprintf buffer that is later executed by a shell interpreter. Metacharacters such as `, ;, &, |, and $() are not filtered or escaped.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to the vulnerable /protocol.csp endpoint with a malicious payload in the enable, name, or mac parameter. No authentication or user interaction is required. Public proof-of-concept material is available in the GitHub PoC repository.

// No verified exploit code is reproduced here.
// See the public PoC at https://github.com/IEATASICS/m300-repeater-bugs
// and the VulDB entry at https://vuldb.com/cve/CVE-2026-19348 for technical details.

Detection Methods for CVE-2026-19348

Indicators of Compromise

HTTP requests to /protocol.csp containing shell metacharacters (;, |, `, $()) in the enable, name, or mac parameters
Unexpected child processes spawned by the device web server such as sh, wget, curl, busybox, or nc
Outbound connections from the repeater to unfamiliar IP addresses or download of binaries to /tmp
Modifications to persistent configuration or startup scripts on the device

Detection Strategies

Inspect network traffic for HTTP requests matching the /protocol.csp?fname=net&opt=smacfilter_conf pattern with abnormal parameter content
Correlate DNS lookups and egress traffic originating from repeater management IPs against threat intelligence feeds
Baseline expected management traffic and alert on deviations, including requests from non-administrative subnets

Monitoring Recommendations

Log and retain HTTP request bodies from IoT and network device management planes
Alert on any inbound traffic to consumer repeater management endpoints from WAN interfaces
Monitor for firmware or configuration changes on M300 devices outside of maintenance windows

How to Mitigate CVE-2026-19348

Immediate Actions Required

Remove exposure of the M300 management interface from the WAN and any untrusted network segments
Restrict access to /protocol.csp to a dedicated management VLAN using upstream firewall rules
Rotate any credentials that transited through the affected repeater, assuming potential interception
Inventory environments for Shenzhen Aitemi M300 devices and flag those running firmware r0-ea7890a

Patch Information

No vendor patch or security advisory from Shenzhen Aitemi is referenced in the CVE data. Consult the VulDB entry for CVE-2026-19348 for updates. Until a firmware fix is issued, treat affected devices as unpatchable and plan for replacement in security-sensitive deployments.

Workarounds

Place the repeater behind a firewall that blocks all inbound access to TCP ports used by the web management interface
Disable remote management features and require physical or VPN access for administration
Replace affected devices with hardware that receives active vendor security support where feasible

bash

# Example upstream firewall rule to block WAN access to the repeater management interface
# Adjust REPEATER_IP and MGMT_PORT to match your deployment
iptables -A FORWARD -d <REPEATER_IP> -p tcp --dport <MGMT_PORT> -i <WAN_IF> -j DROP
iptables -A INPUT   -d <REPEATER_IP> -p tcp --dport <MGMT_PORT> -i <WAN_IF> -j DROP