Quantenna Wi Fi Chipset
Approved changes feed: RSS · Atom
cpe:2.3:a:on_semiconductor:quantenna_wi-fi_chipset:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | On Semiconductor (36c7aaeb-07f7-51ea-8ae2-ec86fff92f84) |
|---|---|
| Product | Quantenna Wi Fi Chipset (0c3dbc96-754c-5a91-bd9b-2367b12d069a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-3461 |
vulnerable | 2026-06-08 07:23:08.923071 |
ON Semiconductor Quantenna Telnet Missing Authentication
CRITICAL (9.1)
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Published: 2025-06-08T21:02:37.521Z
Updated: 2025-06-09T18:37:14.718Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3460 |
vulnerable | 2026-06-08 07:23:08.920019 |
ON Semiconductor Quantenna set_tx_pow Argument Injection
HIGH (7.7)
The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Published: 2025-06-08T21:02:24.334Z
Updated: 2025-06-09T18:33:57.925Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-3459 |
vulnerable | 2026-06-08 07:23:08.887362 |
ON Semiconductor Quantenna transmit_file Argument Injection
HIGH (7.7)
The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Published: 2025-06-08T21:02:09.918Z
Updated: 2025-06-09T18:36:35.345Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32459 |
vulnerable | 2026-06-08 07:19:00.081242 |
ON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument Injection
HIGH (7.7)
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Published: 2025-06-08T21:04:25.317Z
Updated: 2025-06-10T13:22:40.590Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32458 |
vulnerable | 2026-06-08 07:19:00.078463 |
ON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument Injection
HIGH (7.7)
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Published: 2025-06-08T21:04:12.492Z
Updated: 2025-06-10T13:23:10.764Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32457 |
vulnerable | 2026-06-08 07:19:00.076345 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32456 |
vulnerable | 2026-06-08 07:19:00.074076 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32455 |
vulnerable | 2026-06-08 07:19:00.049162 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.