{"cve":"CVE-2025-34152","enrichment":{"created":"2025-08-12T07:49:23.803305+00:00","updated":"2025-08-12T07:49:23.803390+00:00","vendors":["shenzhen_aitemi","shenzhen_aitemi$PRODUCT$m300_wifi_repeater"]},"epss":{"score":0.68599},"mitre":{"cpes":["cpe:2.3:h:shenzhen_aitemi:m300:-:*:*:*:*:*:*:*"],"created":"2025-08-07T16:44:59.919000+00:00","description":"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"mitre_repo_path":"cves/2025/34xxx/CVE-2025-34152.json","references":["https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/","https://www.aliexpress.us/item/3256806767641280.html","https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-time-parameter"],"title":"Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter","updated":"2025-12-01T16:32:10.204000+00:00","vendors":["shenzhen_aitemi","shenzhen_aitemi$PRODUCT$m300"],"weaknesses":["CWE-78"]},"nvd":{"cpes":[],"created":"2025-08-07T17:15:29.183000+00:00","description":"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2025/CVE-2025-34152.json","references":["https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/","https://www.aliexpress.us/item/3256806767641280.html","https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-time-parameter"],"title":null,"updated":"2026-06-17T09:13:33.313000+00:00","vendors":[],"weaknesses":["CWE-78"]},"opencve":{"changes":[{"created":"2025-08-07T17:00:00+00:00","data":[{"details":{"new":"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.","old":null},"type":"description"},{"details":{"new":"Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter","old":null},"type":"title"},{"details":{"added":["CWE-78"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/","https://www.aliexpress.us/item/3256806767641280.html"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"26d6a178-a66c-4835-b36e-7de8424e906d"},{"created":"2025-08-07T19:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"86246157-1d2d-47d9-8186-bef8069eb441"},{"created":"2025-08-12T08:00:00+00:00","data":[{"details":["shenzhen_aitemi","shenzhen_aitemi$PRODUCT$m300_wifi_repeater"],"type":"first_time"},{"details":{"added":["shenzhen_aitemi","shenzhen_aitemi$PRODUCT$m300_wifi_repeater"],"removed":[]},"type":"vendors"}],"id":"f5b88083-054e-49e2-a2bc-29721c727875"},{"created":"2025-11-04T22:30:00+00:00","data":[{"details":{"added":["https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-time-parameter"],"removed":[]},"type":"references"}],"id":"1bc7c643-c716-4235-b44c-28a7a769526e"},{"created":"2025-11-20T16:30:00+00:00","data":[{"details":{"added":["ccpe:2.3:h:shenzhen_aitemi:m300:-:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"994f4b9a-38a4-4148-a35f-efbcd4970039"},{"created":"2025-11-21T01:15:00+00:00","data":[{"details":["shenzhen_aitemi$PRODUCT$m300"],"type":"first_time"},{"details":{"added":["cpe:2.3:h:shenzhen_aitemi:m300:-:*:*:*:*:*:*:*"],"removed":["ccpe:2.3:h:shenzhen_aitemi:m300:-:*:*:*:*:*:*:*"]},"type":"cpes"},{"details":{"added":["shenzhen_aitemi$PRODUCT$m300"],"removed":[]},"type":"vendors"}],"id":"ebfb758f-97e4-41ef-8431-0b9852168cf6"}],"cpes":{"data":["cpe:2.3:h:shenzhen_aitemi:m300:-:*:*:*:*:*:*:*"],"providers":["mitre"]},"created":{"data":"2025-08-07T16:44:59.919000+00:00","provider":"mitre"},"description":{"data":"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{"score":9.4,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},"provider":"mitre"},"epss":{"data":{"score":0.68599},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/","https://www.aliexpress.us/item/3256806767641280.html","https://www.vulncheck.com/advisories/shenzhen-aitemi-m300-wifi-repeater-os-command-injection-via-time-parameter"],"providers":["mitre","nvd"]},"title":{"data":"Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter","provider":"mitre"},"updated":{"data":"2026-04-15T00:35:42.020000+00:00","provider":"nvd"},"vendors":{"data":["shenzhen_aitemi","shenzhen_aitemi$PRODUCT$m300","shenzhen_aitemi$PRODUCT$m300_wifi_repeater"],"providers":["mitre","enrichment"]},"weaknesses":{"data":["CWE-78"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2025-08-07T16:44:59.919000+00:00","description":"An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":[],"title":"Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter","updated":"2025-08-07T18:39:44.157000+00:00","vendors":[],"vulnrichment_repo_path":"2025/34xxx/CVE-2025-34152.json","weaknesses":[]}}