What is the CVSS score of CVE-2025-32457?

CVE-2025-32457 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Qcs Ax2 A12 Firmware are affected by CVE-2025-32457?

A command injection vulnerability in Quantenna Wi-Fi chipsets (affecting versions through 8.0.0.28) allows local attackers to execute arbitrary commands with elevated privileges, potentially…

How to fix or mitigate CVE-2025-32457?

Within 24 hours: Inventory all devices using Quantenna Wi-Fi chipsets and identify those running affected SDK versions (≤8.0.0.28); restrict local administrative access to router command interfaces. Within 7 days: Implement network segmentation to limit lateral movement from compromised routers; review access logs for suspicious local command activity. Within 30 days: Contact Quantenna/chipset integrators for patched firmware; evaluate vendor best practices guidance for hardening; consider replacement with patched hardware if timeline for updates is unclear.

Qcs Ax2 A12 Firmware CVE-2025-32457

EUVD-2025-17408 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2025-06-08 cve@takeonme.org

Command Injection Qcs Ax2 A12 Firmware Qcs Ax2 S5 Firmware Qcs Ax2 T12 Firmware Qcs Ax2 T8 Firmware Qcs Ax3 A12 Firmware Qcs Ax3 S5 Firmware Qcs Ax3 T12 Firmware Qcs Ax3 T8 Firmware Qd840 Firmware Qhs710 Firmware Qsr10ga Firmware Qsr10gu Firmware Qv840 Firmware Qv840c Firmware Qv860 Firmware Qv940 Firmware Qv942c Firmware Qv952c Firmware Onsemi

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:17 euvd

EUVD-2025-17408

Analysis Generated

Mar 14, 2026 - 19:17 vuln.today

CVE Published

Jun 08, 2025 - 21:15 nvd

HIGH 7.7

DescriptionCVE.org

The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS 7.7 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.