Command Injection Vulnerability in Quantenna Wi-Fi Chipset
CVE-2025-32457

7.7HIGH

Key Information:

Vendor

On Semiconductor

Status
Quantenna Wi-fi Chipset
Vendor
CVE Published:
8 June 2025

What is CVE-2025-32457?

The Quantenna Wi-Fi chipset is vulnerable to command injection via the local control script router_command.sh, specifically in the get_file_from_qtn argument. This vulnerability arises from improper neutralization of argument delimiters in commands, classified under CWE-88. It affects the Quantenna Wi-Fi chipset SDK up to version 8.0.0.28 and remains unpatched. Quantenna has, however, provided a best practices guide for implementors to mitigate potential risks associated with this issue.

Affected Version(s)

Quantenna Wi-Fi chipset 0 <= 8.0.0.28

References

https://takeonme.org/cves/cve-2025-3460
third-party-advisory
https://community.onsemi.com/s/article/QCS-Quantenna-Wi-F...
vendor-advisory

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ricky "HeadlessZeke" Lawshae of Keysight
todb
.
CVE-2025-32457 : Command Injection Vulnerability in Quantenna Wi-Fi Chipset