EUVD-2025-17410Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
AnalysisAI
Quantenna Wi-Fi chipsets ship with an unauthenticated telnet interface enabled by default, allowing remote attackers to gain full administrative access without credentials. This affects Quantenna Wi-Fi chipset SDK through version 8.0.0.28, and while no official patch has been released at the time of CVE publication, the vendor has provided a best practices guide for implementors. The vulnerability enables both complete confidentiality and integrity compromise of affected devices.
Technical ContextAI
The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the Quantenna Wi-Fi chipset exposes a telnet service on the default management interface without requiring any authentication mechanism. Telnet is an unencrypted remote access protocol that transmits credentials and commands in plaintext over the network. The affected technology is the Quantenna Wi-Fi chipset SDK (version ≤8.0.0.28), which is embedded in various Wi-Fi access points, routers, and networking devices. This represents a classic case of insecure-by-default configuration where device manufacturers failed to implement proper access controls on critical administrative interfaces. The issue is particularly severe because telnet is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N).
RemediationAI
Immediate mitigation options: (1) Disable telnet service on affected devices through administrative interfaces if available; (2) Implement network-level segmentation to restrict telnet access (port 23) to management interfaces, blocking direct Internet access; (3) Deploy firewall rules to deny inbound telnet connections from untrusted networks; (4) Monitor network traffic for telnet connections to Wi-Fi infrastructure devices. Official patches: Quantenna has not released a security patch; vendors must await patched SDK versions. Contact your device manufacturer (router/AP vendor) to determine if they have released firmware updates addressing this vulnerability through Quantenna patches. The 'best practices guide' referenced should be reviewed to understand hardening recommendations, though this does not constitute a complete fix. Long-term: Upgrade to devices using patched Quantenna SDK versions (>8.0.0.28) once available, or replace with alternative Wi-Fi chipsets from vendors prioritizing secure-by-default configurations.
More in Qcs Ax2 A12 Firmware
View allCommand injection vulnerability in Quantenna Wi-Fi chipset control scripts (specifically the set_tx_pow utility) that al
A command injection vulnerability (CVSS 7.7). High severity vulnerability requiring prompt remediation.
A command injection vulnerability exists in the Quantenna Wi-Fi chipset's router_command.sh script, specifically in the
Command injection vulnerability in Quantenna Wi-Fi chipset control scripts (router_command.sh) that allows local, unauth
A command injection vulnerability (CVSS 7.7). High severity vulnerability requiring prompt remediation.
A command injection vulnerability exists in the Quantenna Wi-Fi chipset's router_command.sh script affecting versions th
A command injection vulnerability exists in the Quantenna Wi-Fi chipset's router_command.sh local control script, allowi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today