CVE-2026-19348

Name of the Vulnerable Software and Affected Versions Shenzhen Aitemi M300 Wi-Fi Repeater version r0-ea7890a

Description A remote command injection flaw exists due to improper handling of arguments in the sprintf() function within the /protocol.csp?fname=net&opt=smacfilter conf&function=set&act=add&name=test&enable=1 endpoint. An attacker can trigger this by manipulating the enable, name, or mac variables.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /protocol.csp endpoint to minimize the risk of exploitation.