CVE-2025-3460

Published: Jun 8, 2025Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

Affected (18)

Products: Onsemi: Qcs Ax3 S5 Firmware, Qcs Ax2 A12 Firmware, Qcs Ax2 T12 Firmware, Qcs Ax2 T8 Firmware, Qd840 Firmware, Qhs710 Firmware, Qsr10ga Firmware, Qsr10gu Firmware, Qv840 Firmware, Qv840c Firmware, Qv860 Firmware, Qv940 Firmware, Qv942c Firmware, Qv952c Firmware, Qcs Ax2 S5 Firmware, Qcs Ax3 A12 Firmware, Qcs Ax3 T12 Firmware, Qcs Ax3 T8 Firmware

18 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax3 S5 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax3 S5	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax2 A12 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax2 A12	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax2 T12 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax2 T12	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax2 T8 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax2 T8	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qd840 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qd840	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qhs710 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qhs710	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qsr10ga Firmware	All versions

Running on/with	Platform Versions
Onsemi Qsr10ga	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qsr10gu Firmware	All versions

Running on/with	Platform Versions
Onsemi Qsr10gu	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qv840 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qv840	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qv840c Firmware	All versions

Running on/with	Platform Versions
Onsemi Qv840c	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qv860 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qv860	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qv940 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qv940	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qv942c Firmware	All versions

Running on/with	Platform Versions
Onsemi Qv942c	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qv952c Firmware	All versions

Running on/with	Platform Versions
Onsemi Qv952c	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax2 S5 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax2 S5	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax3 A12 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax3 A12	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax3 T12 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax3 T12	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Onsemi Qcs Ax3 T8 Firmware	All versions

Running on/with	Platform Versions
Onsemi Qcs Ax3 T8	All versions

Related CWEs

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (2)

https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices

Source: cve@takeonme.org

Release Notes

https://takeonme.org/cves/cve-2025-3460

Source: cve@takeonme.org

ExploitThird Party Advisory

Timeline

No history available yet.