PT-2025-24371 · Quantenna · Quantenna Wi-Fi Chipset

Todb · Published 2025-03-27 · Updated 2026-01-21 · CVE-2025-32458

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quantenna Wi-Fi chipset versions through 8.0.0.28

Description The Quantenna Wi-Fi chipset has a local control script, router command.sh, that is vulnerable to command injection, specifically in the get syslog from qtn argument. This issue is related to improper neutralization of argument delimiters in a command. The vendor has released a best practices guide for implementors of this chipset.

Recommendations For versions through 8.0.0.28, consider disabling the router command.sh script or restricting its use until a patch is available. Implement the best practices guide provided by the vendor to minimize the risk of exploitation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2025-06627

CVE-2025-32458

Affected Products

Quantenna Wi-Fi Chipset

References · 14

• https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32458 · Security Note
• https://bdu.fstec.ru/vul/2025-06627 · Security Note
• https://t.me/cvetracker/25718 · Telegram Post
• https://t.me/latest_high_impact_cve/2577 · Telegram Post
• https://twitter.com/cracbot/status/1933117132855988476 · Twitter Post
• https://t.me/cveNotify/149406 · Telegram Post
• https://twitter.com/cracbot/status/1933479508352393554 · Twitter Post
• https://takeonme.org/cves/cve-2025-3460 · Note
• https://twitter.com/CVEnew/status/1931825978583457991 · Twitter Post
• https://t.me/latest_high_impact_cve/2578 · Telegram Post
• https://takeonme.org/cves/cve-2025-32458 · Note
• https://twitter.com/VulmonFeeds/status/1931862650503192869 · Twitter Post
• https://t.me/cvenotify/125018 · Telegram Post