CVE-2025-32459
BaseFortify
Publication date: 2025-06-08
Last updated on: 2026-01-21
Assigner: Austin Hackers Anonymous
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onsemi | qcs-ax3-s5_firmware | * |
| onsemi | qcs-ax3-s5 | * |
| onsemi | qcs-ax2-a12_firmware | * |
| onsemi | qcs-ax2-a12 | * |
| onsemi | qcs-ax2-t12_firmware | * |
| onsemi | qcs-ax2-t12 | * |
| onsemi | qcs-ax2-t8_firmware | * |
| onsemi | qcs-ax2-t8 | * |
| onsemi | qd840_firmware | * |
| onsemi | qd840 | * |
| onsemi | qhs710_firmware | * |
| onsemi | qhs710 | * |
| onsemi | qsr10ga_firmware | * |
| onsemi | qsr10ga | * |
| onsemi | qsr10gu_firmware | * |
| onsemi | qsr10gu | * |
| onsemi | qv840_firmware | * |
| onsemi | qv840 | * |
| onsemi | qv840c_firmware | * |
| onsemi | qv840c | * |
| onsemi | qv860_firmware | * |
| onsemi | qv860 | * |
| onsemi | qv940_firmware | * |
| onsemi | qv940 | * |
| onsemi | qv942c_firmware | * |
| onsemi | qv942c | * |
| onsemi | qv952c_firmware | * |
| onsemi | qv952c | * |
| onsemi | qcs-ax2-s5_firmware | * |
| onsemi | qcs-ax2-s5 | * |
| onsemi | qcs-ax3-a12_firmware | * |
| onsemi | qcs-ax3-a12 | * |
| onsemi | qcs-ax3-t12_firmware | * |
| onsemi | qcs-ax3-t12 | * |
| onsemi | qcs-ax3-t8_firmware | * |
| onsemi | qcs-ax3-t8 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Quantenna Wi-Fi chipset's local control script called router_command.sh, specifically in the sync_time argument. It is a command injection vulnerability (CWE-88) where improper neutralization of argument delimiters allows an attacker to inject and execute arbitrary commands. This can happen because the script does not properly sanitize input, leading to potential unauthorized command execution.
How can this vulnerability impact me? :
The vulnerability can lead to high impact on confidentiality and integrity of the affected system, as indicated by the CVSS score. An attacker with local access could execute arbitrary commands on the device, potentially gaining control over sensitive data or altering system behavior. This could compromise the security of the device and any network it is connected to.