CVE-2025-3461
Analyzed Analyzed - Analysis Complete
BaseFortify

Publication date: 2025-06-08

Last updated on: 2026-01-13

Assigner: Austin Hackers Anonymous

Description
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-06-08
Last Modified
2026-01-13
Generated
2026-05-07
AI Q&A
2025-06-09
EPSS Evaluated
2026-05-05
NVD
CVE-2025-3461
Affected Vendors & Products
Showing 36 associated CPEs
Vendor Product Version / Range
onsemi qhs710_firmware *
onsemi qhs710 *
onsemi qsr10ga_firmware *
onsemi qsr10ga *
onsemi qsr10gu_firmware *
onsemi qsr10gu *
onsemi qv840_firmware *
onsemi qv840 *
onsemi qv840c_firmware *
onsemi qv840c *
onsemi qv860_firmware *
onsemi qv860 *
onsemi qv940_firmware *
onsemi qv940 *
onsemi qv942c_firmware *
onsemi qv942c *
onsemi qv952c_firmware *
onsemi qv952c *
onsemi qcs-ax2-s5_firmware *
onsemi qcs-ax2-s5 *
onsemi qcs-ax3-a12_firmware *
onsemi qcs-ax3-a12 *
onsemi qcs-ax3-t12_firmware *
onsemi qcs-ax3-t12 *
onsemi qcs-ax3-t8_firmware *
onsemi qcs-ax3-t8 *
onsemi qcs-ax3-s5_firmware *
onsemi qcs-ax3-s5 *
onsemi qcs-ax2-a12_firmware *
onsemi qcs-ax2-a12 *
onsemi qcs-ax2-t12_firmware *
onsemi qcs-ax2-t12 *
onsemi qcs-ax2-t8_firmware *
onsemi qcs-ax2-t8 *
onsemi qd840_firmware *
onsemi qd840 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves Quantenna Wi-Fi chips that have an unauthenticated telnet interface enabled by default. This means that anyone can access the telnet interface without needing to provide credentials, which is a missing authentication for a critical function (CWE-306).


How can this vulnerability impact me? :

Because the telnet interface is unauthenticated, an attacker can remotely access and control the affected Wi-Fi chipset without authorization. This can lead to a complete compromise of confidentiality and integrity of the device, allowing attackers to intercept data or manipulate device functions.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart