CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2025-32456
High (7.8) in onsemi. EPSS 0.6% chance of exploitation in the next 30 days.
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
- CWE
- CWE-88
- Published
- Modified
- Record from
- the NVD, synced
Affected
- onsemi:qcs-ax2-a12_firmware
- onsemi:qcs-ax2-s5_firmware
- onsemi:qcs-ax2-t12_firmware
- onsemi:qcs-ax2-t8_firmware
- onsemi:qcs-ax3-a12_firmware
- onsemi:qcs-ax3-s5_firmware
- onsemi:qcs-ax3-t12_firmware
- onsemi:qcs-ax3-t8_firmware
- onsemi:qd840_firmware
- onsemi:qhs710_firmware
- onsemi:qsr10ga_firmware
- onsemi:qsr10gu_firmware
- onsemi:qv840_firmware
- onsemi:qv840c_firmware
- onsemi:qv860_firmware
- onsemi:qv940_firmware
- onsemi:qv942c_firmware
- onsemi:qv952c_firmware