CVE-2025-32456

ON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument Injection

Published Jun 8, 2025 CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Description
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-17407 The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
History
Type Values Removed Values Added
First Time appeared Onsemi
Onsemi qcs-ax2-a12
Onsemi qcs-ax2-a12 Firmware
Onsemi qcs-ax2-s5
Onsemi qcs-ax2-s5 Firmware
Onsemi qcs-ax2-t12
Onsemi qcs-ax2-t12 Firmware
Onsemi qcs-ax2-t8
Onsemi qcs-ax2-t8 Firmware
Onsemi qcs-ax3-a12
Onsemi qcs-ax3-a12 Firmware
Onsemi qcs-ax3-s5
Onsemi qcs-ax3-s5 Firmware
Onsemi qcs-ax3-t12
Onsemi qcs-ax3-t12 Firmware
Onsemi qcs-ax3-t8
Onsemi qcs-ax3-t8 Firmware
Onsemi qd840
Onsemi qd840 Firmware
Onsemi qhs710
Onsemi qhs710 Firmware
Onsemi qsr10ga
Onsemi qsr10ga Firmware
Onsemi qsr10gu
Onsemi qsr10gu Firmware
Onsemi qv840
Onsemi qv840 Firmware
Onsemi qv840c
Onsemi qv840c Firmware
Onsemi qv860
Onsemi qv860 Firmware
Onsemi qv940
Onsemi qv940 Firmware
Onsemi qv942c
Onsemi qv942c Firmware
Onsemi qv952c
Onsemi qv952c Firmware
CPEs cpe:2.3:h:onsemi:qcs-ax2-a12:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-s5:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t12:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax2-t8:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-a12:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-s5:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t12:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qcs-ax3-t8:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qd840:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qhs710:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10ga:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qsr10gu:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv840c:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv860:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv940:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv942c:-:*:*:*:*:*:*:*
cpe:2.3:h:onsemi:qv952c:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*
Vendors & Products Onsemi
Onsemi qcs-ax2-a12
Onsemi qcs-ax2-a12 Firmware
Onsemi qcs-ax2-s5
Onsemi qcs-ax2-s5 Firmware
Onsemi qcs-ax2-t12
Onsemi qcs-ax2-t12 Firmware
Onsemi qcs-ax2-t8
Onsemi qcs-ax2-t8 Firmware
Onsemi qcs-ax3-a12
Onsemi qcs-ax3-a12 Firmware
Onsemi qcs-ax3-s5
Onsemi qcs-ax3-s5 Firmware
Onsemi qcs-ax3-t12
Onsemi qcs-ax3-t12 Firmware
Onsemi qcs-ax3-t8
Onsemi qcs-ax3-t8 Firmware
Onsemi qd840
Onsemi qd840 Firmware
Onsemi qhs710
Onsemi qhs710 Firmware
Onsemi qsr10ga
Onsemi qsr10ga Firmware
Onsemi qsr10gu
Onsemi qsr10gu Firmware
Onsemi qv840
Onsemi qv840 Firmware
Onsemi qv840c
Onsemi qv840c Firmware
Onsemi qv860
Onsemi qv860 Firmware
Onsemi qv940
Onsemi qv940 Firmware
Onsemi qv942c
Onsemi qv942c Firmware
Onsemi qv952c
Onsemi qv952c Firmware
Type Values Removed Values Added
Description The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) . This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset. The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) . This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Title ON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument Injection
Weaknesses CWE-88
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}