CVE-2025-32455 ON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument Injection
Local attackers can inject commands into the router_command.sh script to execute arbitrary code and escalate privileges on devices using the Quantenna Wi-Fi chipset.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32455?
CVE-2025-32455 is a high-severity command injection vulnerability in ON Semiconductor Quantenna Wi-Fi chipset, published on 8 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
Weakness: CWE-88
Which versions are affected by CVE-2025-32455?
It affects 18 products.
Products include Onsemi Qcs-Ax2-A12 Firmware, Onsemi Qcs-Ax2-S5 Firmware, Onsemi Qcs-Ax2-T12 Firmware, Onsemi Qcs-Ax2-T8 Firmware, Onsemi Qcs-Ax3-A12 Firmware, Onsemi Qcs-Ax3-S5 Firmware and 12 more.
How do I fix CVE-2025-32455?
No fix has been published for CVE-2025-32455 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-32455 being exploited?
There is no known exploitation of CVE-2025-32455 in the wild and no public exploit code.
Other vulnerabilities in ON Semiconductor Quantenna Wi-Fi chipset
- CVE-2025-3461 ON Semiconductor Quantenna Telnet Missing Authentication
- CVE-2025-32456 ON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument Injection
- CVE-2025-32457 ON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument Injection
- CVE-2025-32458 ON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument Injection
- CVE-2025-32459 ON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument Injection
Sources
Also known as GHSA-wwc6-hv89-4c8g.