The vulnerability is an unsanitized input handling flaw located in the smacfilter_conf handler of the commuos web backend on the Shenzhen Aitemi M300 Wi‑Fi Repeater MT02. Legacy C sprintf calls concatenate user supplied values from the name, enable, and mac query parameters directly into a uci shell command, which is then executed with root privileges via doSystemCmdComlib(). By appending shell‑separator characters such as semicolons, an attacker can inject arbitrary shell commands, achieving full control of the device. This weakness is classified as CWE‑78: Improper Neutralization of Special Elements used in an OS Command.

Affected devices are the Shenzhen Aitemi M300 Wi‑Fi Repeater model MT02, provided by Shenzhen Aitemi E Commerce Co. Ltd. The CVE description does not provide specific firmware versions, indicating the flaw exists in all builds that include the vulnerable smacfilter_conf endpoint, which is reachable through the protocol.csp endpoint of the commuos web service.

The CVSS score of 9.3 highlights a critical severity that permits unrestricted root access on the device. An EPSS score of 3 % indicates a moderate likelihood of exploitation, and the flaw is not yet listed in the CISA KEV catalog. Attackers need only local network connectivity and no authentication to reach the vulnerable HTTP interface, making exploitation technically feasible and potentially catastrophic for any network segment that trusts the repeater.