ON Semiconductor Quantenna Wi-Fi Chipset up to 8.0.0.28 router_command.sh sync_time argument injection

Summaryinfo

A vulnerability described as critical has been identified in ON Semiconductor Quantenna Wi-Fi Chipset up to 8.0.0.28. Affected by this vulnerability is an unknown functionality of the file router_command.sh. The manipulation of the argument sync_time results in argument injection. This vulnerability is reported as CVE-2025-32459. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in ON Semiconductor Quantenna Wi-Fi Chipset up to 8.0.0.28. Affected is an unknown code block of the file router_command.sh. The manipulation of the argument sync_time with an unknown input leads to a argument injection vulnerability. CWE is classifying the issue as CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

The weakness was disclosed by Ricky Lawshae. The advisory is shared for download at takeonme.org. This vulnerability is traded as CVE-2025-32459 since 04/09/2025. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-17405). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ON Semiconductor

Name

• Quantenna Wi-Fi Chipset

Version

• 8.0.0.0
• 8.0.0.1
• 8.0.0.2
• 8.0.0.3
• 8.0.0.4
• 8.0.0.5
• 8.0.0.6
• 8.0.0.7
• 8.0.0.8
• 8.0.0.9
• 8.0.0.10
• 8.0.0.11
• 8.0.0.12
• 8.0.0.13
• 8.0.0.14
• 8.0.0.15
• 8.0.0.16
• 8.0.0.17
• 8.0.0.18
• 8.0.0.19
• 8.0.0.20
• 8.0.0.21
• 8.0.0.22
• 8.0.0.23
• 8.0.0.24
• 8.0.0.25
• 8.0.0.26
• 8.0.0.27
• 8.0.0.28

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion