Metermult

**Name of the Vulnerable Software and Affected Versions** Shenzhen Aitemi M300 Wi-Fi Repeater version r0-ea7890a **Description** A remote command injection flaw exists due to improper handling of arguments in the `sprintf()` function within the `/protocol.csp?fname=net&opt=smacfilter conf&function=set&act=add&name=test&enable=1` endpoint. An attacker can trigger this by manipulating the `enable`, `name`, or `mac` variables. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/protocol.csp` endpoint to minimize the risk of exploitation.