CVE-2025-3461
This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.55% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- onsemi/qhs710 firmware · onsemi/qsr10ga firmware · onsemi/qsr10gu firmware · onsemi/qv840 firmware · onsemi/qv840c firmware · onsemi/qv860 firmware · onsemi/qv940 firmware · onsemi/qv942c firmware · onsemi/qv952c firmware · onsemi/qcs-ax2-s5 firmware · onsemi/qcs-ax3-a12 firmware · onsemi/qcs-ax3-t12 firmware · onsemi/qcs-ax3-t8 firmware · onsemi/qcs-ax3-s5 firmware · onsemi/qcs-ax2-a12 firmware · onsemi/qcs-ax2-t12 firmware · onsemi/qcs-ax2-t8 firmware · onsemi/qd840 firmware
- Source
- cve@takeonme.org
References
- https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practicesRelease Notes
- https://takeonme.org/cves/cve-2025-3461/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.