CVE-2025-34152
Published: 07 August 2025
Summary
CVE-2025-34152 is a critical-severity OS Command Injection (CWE-78) vulnerability in Chocapikk (inferred from references). Its CVSS base score is 9.4 (Critical).
Operationally, ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2025-34152 is an unauthenticated OS command injection vulnerability, tracked under CWE-78, that affects the Shenzhen Aitemi M300 Wi-Fi Repeater on hardware model MT02. The flaw resides in the 'time' parameter of the /protocol.csp? endpoint, where unsanitized input is passed directly to the device's internal date '-s' command; exploitation requires no authentication, produces no visible configuration changes, and leaves the HTTP service uninterrupted.
An attacker with network adjacency can supply crafted values to the parameter and execute arbitrary operating-system commands on the device. This grants remote root-level control over the repeater, enabling actions such as persistent access, traffic interception, or lateral movement without triggering reboots or obvious administrative artifacts. The CVSS 4.0 score of 9.4 reflects the combination of network-adjacent attack vector, low complexity, and high impact across confidentiality, integrity, and availability.
EPSS for the CVE rose from a low baseline to a peak of 0.3573 on 2025-12-11 before receding to the current value of 0.2332, indicating a clear increase in observed exploitation interest several months after the August 2025 disclosure. Public references include a detailed technical write-up at chocapikk.com, the product page on AliExpress, and the VulnCheck advisory that catalogs the injection vector.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23927
Vulnerability details
An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '-s' command without rebooting or disrupting HTTP…
more
service. Unlike other injection points, this vector allows remote compromise without triggering visible configuration changes.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.