PT-2025-24369 · Quantenna · Quantenna Wi-Fi Chipset

Todb · Published 2025-03-27 · Updated 2025-06-13 · CVE-2025-32456

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions prior to 8.0.0.28

Description The Quantenna Wi-Fi chipset contains a local control script, router command.sh, that is vulnerable to command injection. This issue is an instance of improper neutralization of argument delimiters in a command. The vendor has released a best practices guide for implementors of this chipset.

Recommendations For versions prior to 8.0.0.28, consider disabling the router command.sh script until a patch is available. Restrict access to the put file to qtn argument to minimize the risk of exploitation. Follow the vendor's best practices guide for implementors of this chipset to reduce the risk of command injection attacks.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2025-06629

CVE-2025-32456

Affected Products

Quantenna Wi-Fi Chipset

References · 12

• https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32456 · Security Note
• https://bdu.fstec.ru/vul/2025-06629 · Security Note
• https://twitter.com/VulmonFeeds/status/1931849851936838030 · Twitter Post
• https://twitter.com/CVEnew/status/1931825980525433000 · Twitter Post
• https://twitter.com/cracbot/status/1933117129123082454 · Twitter Post
• https://t.me/cvetracker/25716 · Telegram Post
• https://takeonme.org/cves/cve-2025-32456 · Note
• https://takeonme.org/cves/cve-2025-3460 · Note
• https://twitter.com/cracbot/status/1933479504942362916 · Twitter Post
• https://t.me/latest_high_impact_cve/2578 · Telegram Post
• https://t.me/cvenotify/125016 · Telegram Post