CVE Daily

CVE-2025-34151

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE ...

Critical CVSS 9.4

Overview

A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The input is passed directly to system-level commands without sanitation, enabling unauthenticated attackers to achieve root-level code execution.

CWE: CWE-78 Published: 2025-08-07T17:15:29.027
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.4 (CRITICAL)
  • Detected tags: command_injection, rce (tag impact: VERY HIGH)

Recommended actions:

  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.

Recommended tools

Tags