{"id":"CVE-2025-3459","aliases":["EUVD-2025-17412","GHSA-84ch-w4f5-gxjw"],"status":"published","title":"ON Semiconductor Quantenna transmit_file Argument Injection","description":"The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00638,"percentile":0.50927,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-88"],"published":"2025-06-08T21:02:09Z","modified":"2026-06-17T09:19:59Z","products":[{"vendor":"on semiconductor","product":"quantenna wi-fi chipset"},{"vendor":"onsemi","product":"qcs-ax2-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t8_firmware"},{"vendor":"onsemi","product":"qcs-ax3-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t8_firmware"},{"vendor":"onsemi","product":"qd840_firmware"},{"vendor":"onsemi","product":"qhs710_firmware"},{"vendor":"onsemi","product":"qsr10ga_firmware"},{"vendor":"onsemi","product":"qsr10gu_firmware"},{"vendor":"onsemi","product":"qv840_firmware"},{"vendor":"onsemi","product":"qv840c_firmware"},{"vendor":"onsemi","product":"qv860_firmware"},{"vendor":"onsemi","product":"qv940_firmware"},{"vendor":"onsemi","product":"qv942c_firmware"},{"vendor":"onsemi","product":"qv952c_firmware"}],"references":[{"url":"https://takeonme.org/cves/cve-2025-3459","tags":["third-party-advisory","Not Applicable"]},{"url":"https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices","tags":["vendor-advisory","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3459"},{"url":"https://github.com/advisories/GHSA-84ch-w4f5-gxjw"}],"sources":{"cve":[{"id":"CVE-2025-3459","title":"ON Semiconductor Quantenna transmit_file Argument Injection","description":"The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:02:09.918Z","modified":"2025-06-09T18:36:35.345Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-17412","description":"The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:02:09Z","modified":"2025-06-09T18:36:35Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:27.346488Z"}],"ghsa":[{"id":"GHSA-84ch-w4f5-gxjw","title":"The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable...","description":"The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:30:31Z","modified":"2025-06-08T21:30:37Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:02:37.263061Z"}],"nvd":[{"id":"CVE-2025-3459","description":"The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:15:32.77Z","modified":"2026-06-17T09:19:59.433Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:11:11.4244Z"}]}}