CVE-2025-3461

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-3461
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices Release Notes
https://takeonme.org/cves/cve-2025-3461/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qhs710:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10ga:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10gu:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840c:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv860:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv940:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv942c:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv952c:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-s5:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-a12:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t12:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t8:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-s5:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-a12:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t12:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t8:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qd840:-:*:*:*:*:*:*:*
History

13 Jan 2026, 20:01

Type Values Removed Values Added
References () https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices - () https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices - Release Notes
References () https://takeonme.org/cves/cve-2025-3461/ - () https://takeonme.org/cves/cve-2025-3461/ - Exploit, Third Party Advisory
First Time Onsemi qv860
Onsemi qcs-ax3-t12
Onsemi qcs-ax2-t8
Onsemi qcs-ax3-a12 Firmware
Onsemi qcs-ax2-t8 Firmware
Onsemi qsr10ga
Onsemi qv840 Firmware
Onsemi qv840
Onsemi qcs-ax3-s5
Onsemi qcs-ax3-s5 Firmware
Onsemi qhs710 Firmware
Onsemi qsr10ga Firmware
Onsemi qcs-ax2-a12
Onsemi qcs-ax2-t12 Firmware
Onsemi qd840
Onsemi qcs-ax2-s5 Firmware
Onsemi qcs-ax3-t8
Onsemi qv952c
Onsemi qv840c Firmware
Onsemi qsr10gu
Onsemi qv942c Firmware
Onsemi qcs-ax3-a12
Onsemi qcs-ax3-t8 Firmware
Onsemi qv840c
Onsemi qcs-ax2-a12 Firmware
Onsemi qv952c Firmware
Onsemi qcs-ax2-s5
Onsemi qv940
Onsemi qd840 Firmware
Onsemi qv940 Firmware
Onsemi qcs-ax2-t12
Onsemi
Onsemi qv860 Firmware
Onsemi qcs-ax3-t12 Firmware
Onsemi qhs710
Onsemi qv942c
Onsemi qsr10gu Firmware
CPE cpe:2.3:h:onsemi:qv860:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv940:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-a12:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t12:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840c:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qd840:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-s5:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t8:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t12:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10ga:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10gu:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t8:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-s5:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qhs710:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv942c:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv952c:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-a12:-:*:*:*:*:*:*:*

09 Jun 2025, 19:15

Type Values Removed Values Added
Summary
  • (es) Los Chips Wi-Fi Quantenna se entregan con una interfaz Telnet no autenticada por defecto. Se trata de una instancia de CWE-306, "Falta de autenticación para función crítica", y se estima que es un CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Este problema afecta al chipset Wi-Fi Quantenna hasta la versión 8.0.0.28 del SDK más reciente y, al parecer, no se había corregido al momento de la publicación inicial de este registro CVE, aunque el proveedor ha publicado una guía de prácticas recomendadas para los implementadores de este chipset.
Summary (en) The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) . This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. (en) The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

08 Jun 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-08 21:15

Updated : 2026-01-13 20:01

NVD link : CVE-2025-3461

Mitre link : CVE-2025-3461

CVE.ORG link : CVE-2025-3461

JSON object : View

Products Affected

onsemi

  • qcs-ax2-t8_firmware
  • qcs-ax2-t12
  • qd840_firmware
  • qv952c
  • qcs-ax3-s5
  • qcs-ax2-s5_firmware
  • qv860
  • qcs-ax3-t12
  • qv840c
  • qhs710_firmware
  • qv942c_firmware
  • qhs710
  • qd840
  • qcs-ax3-a12
  • qcs-ax3-t8_firmware
  • qcs-ax2-t12_firmware
  • qv840
  • qv840c_firmware
  • qcs-ax2-a12
  • qsr10gu_firmware
  • qcs-ax3-t12_firmware
  • qcs-ax2-t8
  • qsr10ga_firmware
  • qcs-ax2-s5
  • qcs-ax3-s5_firmware
  • qcs-ax2-a12_firmware
  • qv940_firmware
  • qv860_firmware
  • qcs-ax3-t8
  • qsr10ga
  • qv942c
  • qv952c_firmware
  • qcs-ax3-a12_firmware
  • qv840_firmware
  • qv940
  • qsr10gu
CWE
CWE-306

Missing Authentication for Critical Function