CVE-2025-32457
BaseFortify
Publication date: 2025-06-08
Last updated on: 2026-01-13
Assigner: Austin Hackers Anonymous
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onsemi | qcs-ax3-s5_firmware | * |
| onsemi | qcs-ax3-s5 | * |
| onsemi | qcs-ax2-a12_firmware | * |
| onsemi | qcs-ax2-a12 | * |
| onsemi | qcs-ax2-t12_firmware | * |
| onsemi | qcs-ax2-t12 | * |
| onsemi | qcs-ax2-t8_firmware | * |
| onsemi | qcs-ax2-t8 | * |
| onsemi | qd840_firmware | * |
| onsemi | qd840 | * |
| onsemi | qhs710_firmware | * |
| onsemi | qhs710 | * |
| onsemi | qsr10ga_firmware | * |
| onsemi | qsr10ga | * |
| onsemi | qsr10gu_firmware | * |
| onsemi | qsr10gu | * |
| onsemi | qv840_firmware | * |
| onsemi | qv840 | * |
| onsemi | qv840c_firmware | * |
| onsemi | qv840c | * |
| onsemi | qv860_firmware | * |
| onsemi | qv860 | * |
| onsemi | qv940_firmware | * |
| onsemi | qv940 | * |
| onsemi | qv942c_firmware | * |
| onsemi | qv942c | * |
| onsemi | qv952c_firmware | * |
| onsemi | qv952c | * |
| onsemi | qcs-ax2-s5_firmware | * |
| onsemi | qcs-ax2-s5 | * |
| onsemi | qcs-ax3-a12_firmware | * |
| onsemi | qcs-ax3-a12 | * |
| onsemi | qcs-ax3-t12_firmware | * |
| onsemi | qcs-ax3-t12 | * |
| onsemi | qcs-ax3-t8_firmware | * |
| onsemi | qcs-ax3-t8 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection issue in the Quantenna Wi-Fi chipset's local control script called router_command.sh. It allows an attacker to inject and execute arbitrary commands due to improper neutralization of argument delimiters, classified as CWE-88. This means the script does not properly sanitize inputs, enabling malicious commands to be run with the privileges of the script.
How can this vulnerability impact me? :
The vulnerability can lead to an attacker executing arbitrary commands on the device running the Quantenna Wi-Fi chipset, potentially compromising confidentiality and integrity of the system. According to the CVSS score, it has high impact on confidentiality and integrity but does not affect availability. This could allow unauthorized access to sensitive data or control over the device.