PT-2025-24368 · Quantenna · Quantenna Wi-Fi Chipset

Todb · Published 2025-03-27 · Updated 2025-06-13 · CVE-2025-32455

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions prior to 8.0.0.29

Description The Quantenna Wi-Fi chipset contains a local control script, router command.sh, that is vulnerable to command injection, specifically an instance of improper neutralization of argument delimiters in a command. This issue is estimated to have a significant impact. The vendor has released a best practices guide for implementors of this chipset.

Recommendations For versions prior to 8.0.0.29, consider disabling the router command.sh script until a patch is available. Restrict access to the run cmd argument to minimize the risk of exploitation. Implement the best practices guide provided by the vendor to reduce the risk of command injection attacks.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2025-06626

CVE-2025-32455

Affected Products

Quantenna Wi-Fi Chipset

References · 11

• https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06626 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-32455 · Security Note
• https://twitter.com/cracbot/status/1933479503281459487 · Twitter Post
• https://twitter.com/CVEnew/status/1931825981393711377 · Twitter Post
• https://takeonme.org/cves/cve-2025-32455 · Note
• https://takeonme.org/cves/cve-2025-3460 · Note
• https://t.me/cvenotify/125015 · Telegram Post
• https://t.me/cvetracker/25715 · Telegram Post
• https://twitter.com/cracbot/status/1933117127487340667 · Twitter Post
• https://t.me/latest_high_impact_cve/2578 · Telegram Post