Command Injection Vulnerability in Quantenna Wi-Fi Chipset

CVE-2025-32455

What is CVE-2025-32455?

The Quantenna Wi-Fi chipset includes a local control script known as router_command.sh that is susceptible to command injection attacks due to improper handling of argument delimiters. This vulnerability, categorized under CWE-88, can allow unauthorized individuals to execute arbitrary commands on the affected devices. As of now, version 8.0.0.28 of the chipset's SDK is known to be vulnerable. While a best practices guide has been released to help implementors mitigate this issue, the vulnerability remains unpatched, posing a significant risk to network security.

References