{"id":"CVE-2025-3460","aliases":["EUVD-2025-17411","GHSA-rmr3-f2f2-5gjh"],"status":"published","title":"ON Semiconductor Quantenna set_tx_pow Argument Injection","description":"The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01002,"percentile":0.63132,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-88"],"published":"2025-06-08T21:02:24Z","modified":"2026-06-17T09:19:59Z","products":[{"vendor":"on semiconductor","product":"quantenna wi-fi chipset"},{"vendor":"onsemi","product":"qcs-ax2-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t8_firmware"},{"vendor":"onsemi","product":"qcs-ax3-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t8_firmware"},{"vendor":"onsemi","product":"qd840_firmware"},{"vendor":"onsemi","product":"qhs710_firmware"},{"vendor":"onsemi","product":"qsr10ga_firmware"},{"vendor":"onsemi","product":"qsr10gu_firmware"},{"vendor":"onsemi","product":"qv840_firmware"},{"vendor":"onsemi","product":"qv840c_firmware"},{"vendor":"onsemi","product":"qv860_firmware"},{"vendor":"onsemi","product":"qv940_firmware"},{"vendor":"onsemi","product":"qv942c_firmware"},{"vendor":"onsemi","product":"qv952c_firmware"}],"references":[{"url":"https://takeonme.org/cves/cve-2025-3460","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices","tags":["vendor-advisory","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3460"},{"url":"https://github.com/advisories/GHSA-rmr3-f2f2-5gjh"}],"sources":{"cve":[{"id":"CVE-2025-3460","title":"ON Semiconductor Quantenna set_tx_pow Argument Injection","description":"The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:02:24.334Z","modified":"2025-06-09T18:33:57.925Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-17411","description":"The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:02:24Z","modified":"2025-06-09T18:33:57Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:27.346488Z"}],"ghsa":[{"id":"GHSA-rmr3-f2f2-5gjh","title":"The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to...","description":"The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:30:31Z","modified":"2025-06-08T21:30:37Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:02:37.263061Z"}],"nvd":[{"id":"CVE-2025-3460","description":"The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:15:32.9Z","modified":"2026-06-17T09:19:59.563Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:11:11.4244Z"}]}}