CVE-2026-58457 Overview
CVE-2026-58457 is an unauthenticated operating system (OS) command injection vulnerability [CWE-78] in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The flaw resides in the smacfilter_conf handler of the commuos web backend. Network-adjacent attackers can inject shell metacharacters into the name, enable, or mac GET parameters. The device passes these values unsanitized into sprintf() to construct uci shell commands, which are then executed through doSystemCmdComlib(). Successful exploitation grants full root-level control of the repeater without requiring authentication.
Critical Impact
Unauthenticated attackers on the same network can achieve root command execution on affected M300 MT02 repeaters, enabling persistent device compromise and pivoting into connected networks.
Affected Products
- Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)
- commuos web backend containing the smacfilter_conf handler
- Firmware versions shipping the vulnerable doSystemCmdComlib() invocation
Discovery Timeline
- 2026-07-01 - CVE-2026-58457 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-58457
Vulnerability Analysis
The vulnerability exists in the smacfilter_conf request handler exposed by the commuos HTTP service running on the M300 MT02 repeater. The handler accepts three GET parameters — name, enable, and mac — that are intended to configure the source MAC address filtering feature. These values are placed directly into a format string passed to sprintf() to build a uci (Unified Configuration Interface) command string. The resulting string is dispatched to doSystemCmdComlib(), which invokes the system shell. Because no character filtering, allow-listing, or shell escaping is performed, a semicolon or other shell metacharacter breaks out of the intended uci command context.
Root Cause
The root cause is missing input validation and unsafe string composition of shell commands. The firmware trusts attacker-controlled HTTP parameters as safe substrings for sprintf()-based command construction. Combined with the absence of authentication on the smacfilter_conf endpoint, any client with network reachability to the repeater's management interface can reach the vulnerable code path.
Attack Vector
Exploitation requires only network access to the repeater's HTTP interface. An attacker submits a crafted GET request in which one of the vulnerable parameters is suffixed with a semicolon followed by an arbitrary shell command. The injected command executes as root because commuos runs with elevated privileges. Refer to the VulnCheck Security Advisory and the GitHub Bug Reports for technical details.
Detection Methods for CVE-2026-58457
Indicators of Compromise
- HTTP GET requests to the smacfilter_conf endpoint containing shell metacharacters such as ;, |, &, or backticks in the name, enable, or mac parameters.
- Unexpected child processes spawned by the commuos binary, particularly shells (/bin/sh) executing non-uci commands.
- New or modified files in persistent storage locations, unexpected outbound connections from the repeater, or altered firewall and DNS configurations.
Detection Strategies
- Inspect web server and reverse proxy logs upstream of the device for query strings targeting smacfilter_conf with URL-encoded semicolons (%3B) or command binaries such as wget, curl, nc, or busybox.
- Deploy network intrusion detection signatures that match GET parameter values containing shell metacharacters against the repeater's management IP.
- Baseline normal uci invocation patterns and alert on process executions that deviate from expected configuration commands.
Monitoring Recommendations
- Monitor management VLANs for unauthenticated HTTP traffic reaching consumer-grade repeaters and log all administrative requests.
- Track DNS queries and outbound connections originating from the repeater's IP address for signs of implant callbacks.
- Alert on repeated requests to smacfilter_conf from single sources, which may indicate scanning or fuzzing activity.
How to Mitigate CVE-2026-58457
Immediate Actions Required
- Remove the M300 MT02 repeater from production networks or place it on an isolated VLAN with no route to sensitive assets.
- Block inbound access to the device's HTTP management interface from untrusted clients using upstream firewall rules.
- Reset the device to factory defaults and inspect for signs of prior compromise before returning it to service.
Patch Information
No vendor patch has been published at the time of NVD publication on 2026-07-01. Consult the VulnCheck Security Advisory for updates on remediation availability.
Workarounds
- Restrict access to the repeater's web management interface to a dedicated administrative host using layer 3 access control lists.
- Disable the MAC filtering configuration workflow if the interface allows it, reducing exposure of the smacfilter_conf handler.
- Replace affected M300 MT02 units with vendor-supported hardware that receives security updates when operational requirements permit.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
