Unauthenticated OS command injection in Shenzhen Aitemi M300 Wi-Fi repeater web backend gives root (CVE-2026-58457)
VulnCheck added this CVE to its known-exploited catalog on 2026-09-04 with public exploit code already available, and anyone still running an M300 with its web backend reachable by untrusted clients is handing out a root shell on the device.
The smacfilter_conf handler in the M300 (hardware model MT02) commuos web backend passes the name, enable, and mac GET parameters unsanitized through sprintf() into uci shell commands run by doSystemCmdComlib(), so anyone who can reach the device's web interface can run arbitrary commands as root. No firmware fix or vendor advisory exists.
Affected: Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02), all known firmware
How to Test
Identify any M300 repeaters (hardware model MT02) on your network. Review the device's web backend for requests to the smacfilter_conf handler whose name, enable, or mac parameters contain semicolons or other shell metacharacters; the public repository at github.com/IEATASICS/m300-repeater-bugs describes the request pattern. Treat unexpected configuration changes, new processes, or altered uci settings as signs of compromise.
How to Mitigate
No vendor fix or advisory is available and affected firmware versions are not enumerated. Move the repeater onto an isolated network segment, ensure its web management interface is not reachable from untrusted Wi-Fi clients or the internet, and plan to replace the device. If compromise is suspected, factory reset it and reconfigure with new credentials.