PT-2025-24370 · Quantenna · Quantenna Wi-Fi Chipset

Todb · Published 2025-03-27 · Updated 2025-06-13 · CVE-2025-32457

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions through 8.0.0.28

Description The Quantenna Wi-Fi chipset has a local control script, router command.sh, that is vulnerable to command injection, specifically in the get file from qtn argument. This issue is an instance of improper neutralization of argument delimiters in a command. The vendor has released a best practices guide for implementors of this chipset.

Recommendations For versions through 8.0.0.28, consider disabling the router command.sh script or restricting its use until a patch is available. Implement the best practices guide provided by the vendor to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2025-06630

CVE-2025-32457

Affected Products

Quantenna Wi-Fi Chipset

References · 12

• https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32457 · Security Note
• https://bdu.fstec.ru/vul/2025-06630 · Security Note
• https://twitter.com/cracbot/status/1933479506649424159 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1931857531619430716 · Twitter Post
• https://takeonme.org/cves/cve-2025-3460 · Note
• https://twitter.com/cracbot/status/1933117130955993241 · Twitter Post
• https://t.me/cvetracker/25717 · Telegram Post
• https://t.me/cvenotify/125017 · Telegram Post
• https://takeonme.org/cves/cve-2025-32457 · Note
• https://twitter.com/CVEnew/status/1931825979573334028 · Twitter Post
• https://t.me/latest_high_impact_cve/2578 · Telegram Post