CVE-2026-58457: Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

Synopsis

This is an OS command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The flaw is reachable over the network and requires no authentication, meaning any attacker who can reach the device's web interface can exploit it by appending shell commands to the name, enable, or mac GET parameters of the protocol.csp endpoint. Successful exploitation gives the attacker full root-level control of the device, including the ability to read data, modify configuration, and disrupt service. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the device's web interface, which is typical for any host on the same network segment or with routed access to the repeater's management port.

• AuthenticationNot required

  No credentials of any kind are required; the smacfilter_conf handler processes GET parameters before any authentication check is applied.

• Victim interactionNot required

  Exploitation is fully automated and does not require any action from a user or administrator on the target device.

• Attack complexityDetail

  The exploit is reliable and condition-free; injected semicolon-delimited payloads are passed directly into a sprintf/shell execution path without any filtering or rate-limiting that would require timing or environmental tuning.

Blast Radius

• Attacker executes arbitrary shell commands as root, gaining full control of the device operating system.
• Attacker reads all stored configuration data, including Wi-Fi credentials, network topology details, and any secrets held on the device.
• Attacker modifies device configuration, redirects DNS, or installs persistent backdoors that survive reboots.
• Attacker crashes or restarts the repeater, severing network connectivity for all clients depending on it.