CVE-2026-58457 describes an unauthenticated OS command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The vulnerability exists in the commuos web backend's smacfilter_conf handler, where attackers can inject semicolon-delimited payloads into the 'name', 'enable', or 'mac' GET parameters. These parameters are unsanitized and passed into sprintf() to build uci shell commands executed via doSystemCmdComlib(), enabling arbitrary command execution with root privileges. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No patch or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated, network-adjacent attacker to execute arbitrary shell commands with root-level privileges on the affected device. This can lead to full compromise of the device, including control over its configuration and operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity. Avoid exposing the device's web backend to untrusted networks.