CVE-2025-32455

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32455
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices Release Notes
https://takeonme.org/cves/cve-2025-3460 Not Applicable
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-s5:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-a12:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t12:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t8:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qd840:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qhs710:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10ga:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10gu:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840c:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv860:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv940:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv942c:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv952c:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-s5:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-a12:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t12:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t8:-:*:*:*:*:*:*:*
History

13 Jan 2026, 20:12

Type Values Removed Values Added
References () https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices - () https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices - Release Notes
References () https://takeonme.org/cves/cve-2025-3460 - () https://takeonme.org/cves/cve-2025-3460 - Not Applicable
CPE cpe:2.3:h:onsemi:qv860:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv940:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-a12:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t12:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840c:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qd840:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-s5:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t8:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t12:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10ga:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10gu:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t8:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-s5:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qhs710:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv942c:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv952c:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-a12:-:*:*:*:*:*:*:*
First Time Onsemi qv860
Onsemi qcs-ax3-t12
Onsemi qcs-ax2-t8
Onsemi qcs-ax3-a12 Firmware
Onsemi qcs-ax2-t8 Firmware
Onsemi qsr10ga
Onsemi qv840 Firmware
Onsemi qv840
Onsemi qcs-ax3-s5
Onsemi qcs-ax3-s5 Firmware
Onsemi qhs710 Firmware
Onsemi qsr10ga Firmware
Onsemi qcs-ax2-a12
Onsemi qcs-ax2-t12 Firmware
Onsemi qd840
Onsemi qcs-ax2-s5 Firmware
Onsemi qcs-ax3-t8
Onsemi qv952c
Onsemi qv840c Firmware
Onsemi qsr10gu
Onsemi qv942c Firmware
Onsemi qcs-ax3-a12
Onsemi qcs-ax3-t8 Firmware
Onsemi qv840c
Onsemi qcs-ax2-a12 Firmware
Onsemi qv952c Firmware
Onsemi qcs-ax2-s5
Onsemi qv940
Onsemi qd840 Firmware
Onsemi qv940 Firmware
Onsemi qcs-ax2-t12
Onsemi
Onsemi qv860 Firmware
Onsemi qcs-ax3-t12 Firmware
Onsemi qhs710
Onsemi qv942c
Onsemi qsr10gu Firmware

09 Jun 2025, 19:15

Type Values Removed Values Added
Summary
  • (es) El Chipset Wi-Fi Quantenna se entrega con un script de control local, router_command.sh (en el argumento run_cmd), vulnerable a la inyección de comandos. Se trata de una instancia de CWE-88, "Neutralización incorrecta de delimitadores de argumentos en un comando ('Inyección de argumentos')", y se estima como CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Este problema afecta al chipset Quantenna Wi-Fi hasta la versión 8.0.0.28 del último SDK, y parece no tener parche en el momento de la primera publicación de este registro CVE, aunque el proveedor ha publicado una guía de mejores prácticas para los implementadores de este chipset.
Summary (en) The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) . This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. (en) The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

08 Jun 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-08 21:15

Updated : 2026-01-13 20:12

NVD link : CVE-2025-32455

Mitre link : CVE-2025-32455

CVE.ORG link : CVE-2025-32455

JSON object : View

Products Affected

onsemi

  • qcs-ax2-t8_firmware
  • qcs-ax2-t12
  • qd840_firmware
  • qv952c
  • qcs-ax3-s5
  • qcs-ax2-s5_firmware
  • qv860
  • qcs-ax3-t12
  • qv840c
  • qhs710_firmware
  • qv942c_firmware
  • qhs710
  • qd840
  • qcs-ax3-a12
  • qcs-ax3-t8_firmware
  • qcs-ax2-t12_firmware
  • qv840
  • qv840c_firmware
  • qcs-ax2-a12
  • qsr10gu_firmware
  • qcs-ax3-t12_firmware
  • qcs-ax2-t8
  • qsr10ga_firmware
  • qcs-ax2-s5
  • qcs-ax3-s5_firmware
  • qcs-ax2-a12_firmware
  • qv940_firmware
  • qv860_firmware
  • qcs-ax3-t8
  • qsr10ga
  • qv942c
  • qv952c_firmware
  • qcs-ax3-a12_firmware
  • qv840_firmware
  • qv940
  • qsr10gu
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')