CVE-2025-32455
BaseFortify
Publication date: 2025-06-08
Last updated on: 2026-01-13
Assigner: Austin Hackers Anonymous
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onsemi | qcs-ax3-s5_firmware | * |
| onsemi | qcs-ax3-s5 | * |
| onsemi | qcs-ax2-a12_firmware | * |
| onsemi | qcs-ax2-a12 | * |
| onsemi | qcs-ax2-t12_firmware | * |
| onsemi | qcs-ax2-t12 | * |
| onsemi | qcs-ax2-t8_firmware | * |
| onsemi | qcs-ax2-t8 | * |
| onsemi | qd840_firmware | * |
| onsemi | qd840 | * |
| onsemi | qhs710_firmware | * |
| onsemi | qhs710 | * |
| onsemi | qsr10ga_firmware | * |
| onsemi | qsr10ga | * |
| onsemi | qsr10gu_firmware | * |
| onsemi | qsr10gu | * |
| onsemi | qv840_firmware | * |
| onsemi | qv840 | * |
| onsemi | qv840c_firmware | * |
| onsemi | qv840c | * |
| onsemi | qv860_firmware | * |
| onsemi | qv860 | * |
| onsemi | qv940_firmware | * |
| onsemi | qv940 | * |
| onsemi | qv942c_firmware | * |
| onsemi | qv942c | * |
| onsemi | qv952c_firmware | * |
| onsemi | qv952c | * |
| onsemi | qcs-ax2-s5_firmware | * |
| onsemi | qcs-ax2-s5 | * |
| onsemi | qcs-ax3-a12_firmware | * |
| onsemi | qcs-ax3-a12 | * |
| onsemi | qcs-ax3-t12_firmware | * |
| onsemi | qcs-ax3-t12 | * |
| onsemi | qcs-ax3-t8_firmware | * |
| onsemi | qcs-ax3-t8 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection issue in the Quantenna Wi-Fi chipset's local control script called router_command.sh. It allows an attacker to inject and execute arbitrary commands due to improper neutralization of argument delimiters in a command, classified as CWE-88. This means that the script does not properly sanitize input, enabling malicious commands to be run on the device.
How can this vulnerability impact me? :
The vulnerability can lead to high impact on confidentiality and integrity of the affected device, as an attacker could execute arbitrary commands locally on the device without requiring privileges or user interaction. This could result in unauthorized access to sensitive information or manipulation of device functions, potentially compromising the security of the network relying on the chipset.