CVE-2025-3459 ON Semiconductor Quantenna transmit_file Argument Injection

High 7.7 Published 8 Jun 2025 Updated 9 Jun 2025

Local attackers can execute arbitrary commands via argument injection in the transmit_file script of Quantenna Wi-Fi chipsets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-3459?

CVE-2025-3459 is a high-severity command injection vulnerability in ON Semiconductor Quantenna Wi-Fi chipset, published on 8 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

Weakness: CWE-88

Which versions are affected by CVE-2025-3459?

It affects 18 products.

Products include Onsemi Qcs-Ax2-A12 Firmware, Onsemi Qcs-Ax2-S5 Firmware, Onsemi Qcs-Ax2-T12 Firmware, Onsemi Qcs-Ax2-T8 Firmware, Onsemi Qcs-Ax3-A12 Firmware, Onsemi Qcs-Ax3-S5 Firmware and 12 more.

How do I fix CVE-2025-3459?

No fix has been published for CVE-2025-3459 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-3459 being exploited?

There is no known exploitation of CVE-2025-3459 in the wild and no public exploit code.

Sources

Also known as GHSA-84ch-w4f5-gxjw.