CVE-2025-32456
BaseFortify
Publication date: 2025-06-08
Last updated on: 2026-01-13
Assigner: Austin Hackers Anonymous
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onsemi | qcs-ax3-s5_firmware | * |
| onsemi | qcs-ax3-s5 | * |
| onsemi | qcs-ax2-a12_firmware | * |
| onsemi | qcs-ax2-a12 | * |
| onsemi | qcs-ax2-t12_firmware | * |
| onsemi | qcs-ax2-t12 | * |
| onsemi | qcs-ax2-t8_firmware | * |
| onsemi | qcs-ax2-t8 | * |
| onsemi | qd840_firmware | * |
| onsemi | qd840 | * |
| onsemi | qhs710_firmware | * |
| onsemi | qhs710 | * |
| onsemi | qsr10ga_firmware | * |
| onsemi | qsr10ga | * |
| onsemi | qsr10gu_firmware | * |
| onsemi | qsr10gu | * |
| onsemi | qv840_firmware | * |
| onsemi | qv840 | * |
| onsemi | qv840c_firmware | * |
| onsemi | qv840c | * |
| onsemi | qv860_firmware | * |
| onsemi | qv860 | * |
| onsemi | qv940_firmware | * |
| onsemi | qv940 | * |
| onsemi | qv942c_firmware | * |
| onsemi | qv942c | * |
| onsemi | qv952c_firmware | * |
| onsemi | qv952c | * |
| onsemi | qcs-ax2-s5_firmware | * |
| onsemi | qcs-ax2-s5 | * |
| onsemi | qcs-ax3-a12_firmware | * |
| onsemi | qcs-ax3-a12 | * |
| onsemi | qcs-ax3-t12_firmware | * |
| onsemi | qcs-ax3-t12 | * |
| onsemi | qcs-ax3-t8_firmware | * |
| onsemi | qcs-ax3-t8 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection issue in the Quantenna Wi-Fi chipset's local control script called router_command.sh. It occurs because the script improperly neutralizes argument delimiters, allowing an attacker with local access to inject and execute arbitrary commands. This is classified as CWE-88, 'Improper Neutralization of Argument Delimiters in a Command ('Argument Injection').
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can execute arbitrary commands with high impact on confidentiality and integrity, potentially leading to unauthorized access or control over the device. However, the attack requires local access to the device, and there is no impact on availability.