{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3459", "assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43", "state": "PUBLISHED", "assignerShortName": "AHA", "dateReserved": "2025-04-08T23:41:07.346Z", "datePublished": "2025-06-08T21:02:09.918Z", "dateUpdated": "2025-06-09T18:36:35.345Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Quantenna Wi-Fi chipset", "vendor": "ON Semiconductor", "versions": [{"lessThanOrEqual": "8.0.0.28", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"}, {"lang": "en", "type": "coordinator", "value": "todb"}], "datePublic": "2025-06-08T21:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).<br><p>This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.</p>"}], "value": "The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43", "shortName": "AHA", "dateUpdated": "2025-06-09T18:36:35.345Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://takeonme.org/cves/cve-2025-3459"}, {"tags": ["vendor-advisory"], "url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"}], "source": {"discovery": "EXTERNAL"}, "title": "ON Semiconductor Quantenna transmit_file Argument Injection", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-09T15:03:20.052450Z", "id": "CVE-2025-3459", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-09T15:03:25.025Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "ON Semiconductor Quantenna transmit_file Argument Injection", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ricky \"HeadlessZeke\" Lawshae of Keysight"}, {"lang": "en", "type": "coordinator", "value": "todb"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ON Semiconductor", "product": "Quantenna Wi-Fi chipset", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.0.0.28"}], "defaultStatus": "unaffected"}], "datePublic": "2025-06-08T21:00:00.000Z", "references": [{"url": "https://takeonme.org/cves/cve-2025-3459", "tags": ["third-party-advisory"]}, {"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.", "supportingMedia": [{"type": "text/html", "value": "The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)\">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)</a>.<br><p>This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43", "shortName": "AHA", "dateUpdated": "2025-06-08T21:02:09.918Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3459", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-09T15:03:20.052450Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-06-09T15:03:22.422Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-3459", "state": "PUBLISHED", "dateUpdated": "2025-06-08T21:02:09.918Z", "dateReserved": "2025-04-08T23:41:07.346Z", "assignerOrgId": "26969f82-7e87-44d8-9cb5-f6fb926ddd43", "datePublished": "2025-06-08T21:02:09.918Z", "assignerShortName": "AHA"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "4C5D4D8E-A41C-4D0C-9578-E69DC5DDB3D9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax3-s5:-:*:*:*:*:*:*:*", "matchCriteriaId": "BB0AC0AF-7C11-4905-B211-111212998385", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "D414E9E4-6F93-4EA8-84DC-905922FDBD06", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax2-a12:-:*:*:*:*:*:*:*", "matchCriteriaId": "79562B8A-BB90-4177-BAB3-1416068267EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE696B7A-5577-4FCB-A03F-E0DC559D59DE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax2-t12:-:*:*:*:*:*:*:*", "matchCriteriaId": "53245E1E-E042-4E5E-AC29-ADD8E2A50B10", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DFEE75DF-ED15-4668-A3A8-045F1FC49146", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax2-t8:-:*:*:*:*:*:*:*", "matchCriteriaId": "9F1B80A5-C5E1-4E27-A29F-AAE8E0CCB5D5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "201FE93B-24B3-4A7C-B70D-DC5BEDAA3ABE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qd840:-:*:*:*:*:*:*:*", "matchCriteriaId": "0AED31B5-45B4-4B29-AFF6-30EA105E614C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "CC1EF23D-0818-45EC-994D-724386942A71", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qhs710:-:*:*:*:*:*:*:*", "matchCriteriaId": "B69BD90A-2A66-4BFB-A0C4-D3ADB8411041", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "3F592DA6-9495-4E3C-A79B-A28DD6874520", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qsr10ga:-:*:*:*:*:*:*:*", "matchCriteriaId": "99041EF1-ED9D-4353-8E01-0B8CB22DA2C3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9AD4080-696E-4C46-B783-9004FA2C45AF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qsr10gu:-:*:*:*:*:*:*:*", "matchCriteriaId": "C87E0F74-9B42-443F-8C3B-8FC9D4BFD510", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DD2BE706-C865-49B1-8362-582F5EBD1ABC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qv840:-:*:*:*:*:*:*:*", "matchCriteriaId": "BB3E4D33-5A1B-4433-91BB-250B3F450E91", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8DDEF7C9-D357-49F9-9EAF-09A1EA553308", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qv840c:-:*:*:*:*:*:*:*", "matchCriteriaId": "6C408E3F-1E76-4C8B-B7B1-66AE354E8F50", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "72DECB62-7BBE-4D28-BEDA-49B7B1B0EEEF", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qv860:-:*:*:*:*:*:*:*", "matchCriteriaId": "188A2714-610D-478D-AC78-6B1ECB630262", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "8B67844F-5D25-480E-A4E7-D1B479B29F18", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qv940:-:*:*:*:*:*:*:*", "matchCriteriaId": "5E753ABE-FB01-44AB-A3B4-11CE6324F695", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "1EBE3DDB-C027-4E42-931F-37049B9342FC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qv942c:-:*:*:*:*:*:*:*", "matchCriteriaId": "844142EA-A9D6-43D0-AAAB-60F278B548E8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "E6DE9F57-D6A3-4754-B8B5-1778AE4744E7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qv952c:-:*:*:*:*:*:*:*", "matchCriteriaId": "3AD87FBC-0311-41E1-84FA-943B61DA24CA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "94644163-15D7-4008-926F-60D2FC9E5C26", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax2-s5:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE3A35F1-8882-4712-9373-0D557F782C21", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB9BA025-1514-444D-A0EC-5E672C5D0D93", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax3-a12:-:*:*:*:*:*:*:*", "matchCriteriaId": "602A5E47-972E-4F89-893B-57526C047F4D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "95A768A1-E025-4D32-81C6-55AE8F099B4C", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax3-t12:-:*:*:*:*:*:*:*", "matchCriteriaId": "290A68E7-3CFC-4517-8FB7-5F372A2B569A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5849D0A2-BE17-46EC-979C-A36B88C1DDC3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:onsemi:qcs-ax3-t8:-:*:*:*:*:*:*:*", "matchCriteriaId": "4221C204-94FD-4951-87FB-F5EAD0E1D315", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset."}, {"lang": "es", "value": "El Chipset Quantenna Wi-Fi se entrega con un script de control local, transmit_file, vulnerable a la inyecci\u00f3n de comandos. Se trata de una instancia de CWE-88, \"Neutralizaci\u00f3n incorrecta de delimitadores de argumentos en un comando ('Inyecci\u00f3n de argumentos')\", y se estima que es CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Este problema afecta al chipset Quantenna Wi-Fi hasta la versi\u00f3n 8.0.0.28 del SDK m\u00e1s reciente y, al parecer, no se hab\u00eda corregido al momento de la publicaci\u00f3n inicial de este registro CVE, aunque el proveedor ha publicado una gu\u00eda de pr\u00e1cticas recomendadas para los implementadores de este chipset."}], "id": "CVE-2025-3459", "lastModified": "2026-01-21T15:58:56.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "cve@takeonme.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-08T21:15:32.770", "references": [{"source": "cve@takeonme.org", "tags": ["Release Notes"], "url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"}, {"source": "cve@takeonme.org", "tags": ["Not Applicable"], "url": "https://takeonme.org/cves/cve-2025-3459"}], "sourceIdentifier": "cve@takeonme.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "cve@takeonme.org", "type": "Secondary"}]}

{}

{}