{"id":"CVE-2025-32458","aliases":["EUVD-2025-17406","GHSA-cgwq-jph9-cvc2"],"status":"published","title":"ON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument Injection","description":"The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00638,"percentile":0.51047,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-88"],"published":"2025-06-08T21:04:12Z","modified":"2026-06-17T09:12:01Z","products":[{"vendor":"on semiconductor","product":"quantenna wi-fi chipset"},{"vendor":"onsemi","product":"qcs-ax2-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t8_firmware"},{"vendor":"onsemi","product":"qcs-ax3-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t8_firmware"},{"vendor":"onsemi","product":"qd840_firmware"},{"vendor":"onsemi","product":"qhs710_firmware"},{"vendor":"onsemi","product":"qsr10ga_firmware"},{"vendor":"onsemi","product":"qsr10gu_firmware"},{"vendor":"onsemi","product":"qv840_firmware"},{"vendor":"onsemi","product":"qv840c_firmware"},{"vendor":"onsemi","product":"qv860_firmware"},{"vendor":"onsemi","product":"qv940_firmware"},{"vendor":"onsemi","product":"qv942c_firmware"},{"vendor":"onsemi","product":"qv952c_firmware"}],"references":[{"url":"https://takeonme.org/cves/cve-2025-3460","tags":["third-party-advisory","Not Applicable"]},{"url":"https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices","tags":["vendor-advisory","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32458"},{"url":"https://github.com/advisories/GHSA-cgwq-jph9-cvc2"}],"sources":{"cve":[{"id":"CVE-2025-32458","title":"ON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument Injection","description":"The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:04:12.492Z","modified":"2025-06-10T13:23:10.764Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-17406","description":"The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:04:12Z","modified":"2025-06-10T13:23:10Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:27.346488Z"}],"ghsa":[{"id":"GHSA-cgwq-jph9-cvc2","title":"The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the...","description":"The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:30:29Z","modified":"2025-06-08T21:30:30Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:02:37.263061Z"}],"nvd":[{"id":"CVE-2025-32458","description":"The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:15:31.537Z","modified":"2026-06-17T09:12:01.51Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:11:11.4244Z"}]}}