{"id":"CVE-2025-3461","aliases":["EUVD-2025-17410","GHSA-f5vv-5ch7-632x"],"status":"published","title":"ON Semiconductor Quantenna Telnet Missing Authentication","description":"The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, \"Missing Authentication for Critical Function,\" and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00577,"percentile":0.47907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2025-06-08T21:02:37Z","modified":"2026-06-17T09:19:59Z","products":[{"vendor":"on semiconductor","product":"quantenna wi-fi chipset"},{"vendor":"onsemi","product":"qcs-ax2-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax2-t8_firmware"},{"vendor":"onsemi","product":"qcs-ax3-a12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-s5_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t12_firmware"},{"vendor":"onsemi","product":"qcs-ax3-t8_firmware"},{"vendor":"onsemi","product":"qd840_firmware"},{"vendor":"onsemi","product":"qhs710_firmware"},{"vendor":"onsemi","product":"qsr10ga_firmware"},{"vendor":"onsemi","product":"qsr10gu_firmware"},{"vendor":"onsemi","product":"qv840_firmware"},{"vendor":"onsemi","product":"qv840c_firmware"},{"vendor":"onsemi","product":"qv860_firmware"},{"vendor":"onsemi","product":"qv940_firmware"},{"vendor":"onsemi","product":"qv942c_firmware"},{"vendor":"onsemi","product":"qv952c_firmware"}],"references":[{"url":"https://takeonme.org/cves/cve-2025-3461/","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices","tags":["vendor-advisory","Release Notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3461"},{"url":"https://takeonme.org/cves/cve-2025-3461"},{"url":"https://github.com/advisories/GHSA-f5vv-5ch7-632x"}],"sources":{"cve":[{"id":"CVE-2025-3461","title":"ON Semiconductor Quantenna Telnet Missing Authentication","description":"The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, \"Missing Authentication for Critical Function,\" and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:02:37.521Z","modified":"2025-06-09T18:37:14.718Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-17410","description":"The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, \"Missing Authentication for Critical Function,\" and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:02:37Z","modified":"2025-06-09T18:37:14Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:32:27.346488Z"}],"ghsa":[{"id":"GHSA-f5vv-5ch7-632x","title":"The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an...","description":"The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, \"Missing Authentication for Critical Function,\" and is estimated as a CVSS 9.1 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:30:31Z","modified":"2025-06-08T21:30:38Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:02:37.263061Z"}],"nvd":[{"id":"CVE-2025-3461","description":"The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, \"Missing Authentication for Critical Function,\" and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.","status":"published","published":"2025-06-08T21:15:33.03Z","modified":"2026-06-17T09:19:59.7Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:11:11.4244Z"}]}}