CVE-2026-19348

CVE-2026-19348 is a command injection vulnerability in the `smacfilter_conf` functionality of a Wi-Fi repeater — specifically in how the device handles the enable, name, and mac parameters when constructing shell commands via sprintf(). Multiple parameters can be injected, meaning an attacker can craft a payload that passes parsing validation but assembles into a working shell command once sprintf() concatenates the final string. The critical detail most defenders miss: this is not a typical IoT RCE. Wi-Fi repeaters operate as transparent bridges at layer 2, forwarding traffic between the upstream AP and all downstream clients. Compromising this device gives you direct MAC-layer adjacency to every device on the repeater's downstream network. Unlike a surveillance camera or thermostat that merely connects to a network segment, the repeater actively extends your reach across a broadcast domain. You can perform ARP sweeps, DHCP fingerprinting, and device enumeration from the compromised repeater, and this traffic looks exactly like ordinary bridge forwarding — there is no anomalous source for network detection logic to flag. The practical implication: treat this as a pivoting vector, not an isolated IoT compromise. If you have this device on your network, assume the attacker has lateral movement capability within that broadcast domain. Network segmentation at the VLAN level does not help — the repeater bridges clients into the same layer 2 domain by design. Worse: this is likely abandoned hardware. The smacfilter_conf functionality is a relic — MAC filtering has been ineffective since WPA3 and 802.1X made MAC spoofing trivial. The sprintf()-to-shell pattern in forgotten code paths is a reliable indicator of unmaintained firmware with no security contact and no update channel. The CVSS 9.8 rating is almost irrelevant because there will probably never be a patch. This device will likely remain exploitable for years, serving as a permanent bridgehead unless physically removed from the network.

Reviewed through automated stages and approved by a human before publication.