CVE-2025-3461
CRITICALDescription
The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| onsemi | qhs710_firmware |
| onsemi | qhs710 |
| onsemi | qsr10ga_firmware |
| onsemi | qsr10ga |
| onsemi | qsr10gu_firmware |
| onsemi | qsr10gu |
| onsemi | qv840_firmware |
| onsemi | qv840 |
| onsemi | qv840c_firmware |
| onsemi | qv840c |
| onsemi | qv860_firmware |
| onsemi | qv860 |
| onsemi | qv940_firmware |
| onsemi | qv940 |
| onsemi | qv942c_firmware |
| onsemi | qv942c |
| onsemi | qv952c_firmware |
| onsemi | qv952c |
| onsemi | qcs-ax2-s5_firmware |
| onsemi | qcs-ax2-s5 |
| onsemi | qcs-ax3-a12_firmware |
| onsemi | qcs-ax3-a12 |
| onsemi | qcs-ax3-t12_firmware |
| onsemi | qcs-ax3-t12 |
| onsemi | qcs-ax3-t8_firmware |
| onsemi | qcs-ax3-t8 |
| onsemi | qcs-ax3-s5_firmware |
| onsemi | qcs-ax3-s5 |
| onsemi | qcs-ax2-a12_firmware |
| onsemi | qcs-ax2-a12 |
| onsemi | qcs-ax2-t12_firmware |
| onsemi | qcs-ax2-t12 |
| onsemi | qcs-ax2-t8_firmware |
| onsemi | qcs-ax2-t8 |
| onsemi | qd840_firmware |
| onsemi | qd840 |
References
Frequently Asked Questions
What is CVE-2025-3461? +
How severe is CVE-2025-3461? +
What products are affected by CVE-2025-3461? +
How do I check if I'm vulnerable to CVE-2025-3461? +
Related Vulnerabilities
An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to …
Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain a valid JWT …
A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR …
A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical …
Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that …
A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 …