CVE-2026-19348CWE-74CWE-77command-injection

CVE-2026-19348

Critical · published August 9, 2026

CVSS v3.1
9.8
EPSS
4%
Percentile
89.3
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test&enable=1. Performing a manipulation of the argument enable/name/mac results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03568 · 89.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-08-09T15:16Z
References (7)
https://github.com/IEATASICS/m300-repeater-bugs · [email protected]https://vuldb.com/cve/CVE-2026-19348 · [email protected]https://vuldb.com/submit/865682 · [email protected]https://vuldb.com/submit/865683 · [email protected]https://vuldb.com/submit/865684 · [email protected]https://vuldb.com/vuln/387184 · [email protected]https://vuldb.com/vuln/387184/cti · [email protected]
EPSS history
Timeline
  • 09 AUG 10:30Z
    Shenzhen Aitemi M300 Wi-Fi Repeater protocol.csp sprintf command injection
    cvelistv5