This vulnerability involves a command injection flaw in the sprintf function of the /protocol.csp endpoint of the Shenzhen Aitemi M300 Wi-Fi Repeater (version r0-ea7890a). By manipulating the enable, name, or mac parameters in a crafted request, an attacker can execute arbitrary commands remotely. The flaw is exploitable without authentication and requires no user interaction. The exploit has been publicly released. No vendor advisory or patch information is currently available.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full device compromise. Given the critical CVSS score of 9.3 and the availability of public exploit code, the risk of attack is high. This could result in unauthorized control over the Wi-Fi repeater, impacting network security and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider isolating the device from untrusted networks and monitoring for suspicious activity. No official mitigation or temporary fix has been documented.