netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3qvj-q9mh-gv5x
GHSA-7m77-2m34-vfr8
GHSA-84ch-w4f5-gxjw
GHSA-8qf9-3v8p-qxx6
GHSA-cgwq-jph9-cvc2
GHSA-f5vv-5ch7-632x
GHSA-f673-3fxm-5g94
GHSA-gxj7-jffw-wpvg
GHSA-pj5v-grmp-4755
GHSA-pvmg-5w26-65m7
GHSA-rf7g-v8g6-48q6
GHSA-rmr3-f2f2-5gjh
GHSA-wc8m-52qp-mpc9
GHSA-wwc6-hv89-4c8g
GHSA-x9cq-hh4v-vrww
This commit is contained in:
advisory-database[bot]
2025-06-08 21:32:06 +00:00
parent e791636a56
commit 1afc380db8
15 changed files with 656 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/06/GHSA-3qvj-q9mh-gv5x/GHSA-3qvj-q9mh-gv5x.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3qvj-q9mh-gv5x",
"modified": "2025-06-08T21:30:29Z",
"published": "2025-06-08T21:30:29Z",
"aliases": [
"CVE-2025-32456"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32456"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3460"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:31Z"
}
}
advisories/unreviewed/2025/06/GHSA-7m77-2m34-vfr8/GHSA-7m77-2m34-vfr8.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7m77-2m34-vfr8",
"modified": "2025-06-08T21:30:30Z",
"published": "2025-06-08T21:30:30Z",
"aliases": [
"CVE-2025-35007"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35007"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35007"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-84ch-w4f5-gxjw/GHSA-84ch-w4f5-gxjw.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84ch-w4f5-gxjw",
"modified": "2025-06-08T21:30:31Z",
"published": "2025-06-08T21:30:31Z",
"aliases": [
"CVE-2025-3459"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3459"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3459"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-8qf9-3v8p-qxx6/GHSA-8qf9-3v8p-qxx6.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8qf9-3v8p-qxx6",
"modified": "2025-06-08T21:30:30Z",
"published": "2025-06-08T21:30:30Z",
"aliases": [
"CVE-2025-35008"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35008"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35008"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-cgwq-jph9-cvc2/GHSA-cgwq-jph9-cvc2.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cgwq-jph9-cvc2",
"modified": "2025-06-08T21:30:29Z",
"published": "2025-06-08T21:30:29Z",
"aliases": [
"CVE-2025-32458"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32458"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3460"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:31Z"
}
}
advisories/unreviewed/2025/06/GHSA-f5vv-5ch7-632x/GHSA-f5vv-5ch7-632x.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f5vv-5ch7-632x",
"modified": "2025-06-08T21:30:31Z",
"published": "2025-06-08T21:30:31Z",
"aliases": [
"CVE-2025-3461"
],
"details": "The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, \"Missing Authentication for Critical Function,\" and is estimated as a CVSS 9.1 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3461"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3461"
}
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:33Z"
}
}
advisories/unreviewed/2025/06/GHSA-f673-3fxm-5g94/GHSA-f673-3fxm-5g94.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f673-3fxm-5g94",
"modified": "2025-06-08T21:30:30Z",
"published": "2025-06-08T21:30:30Z",
"aliases": [
"CVE-2025-35004"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35004"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35004"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:31Z"
}
}
advisories/unreviewed/2025/06/GHSA-gxj7-jffw-wpvg/GHSA-gxj7-jffw-wpvg.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gxj7-jffw-wpvg",
"modified": "2025-06-08T21:30:30Z",
"published": "2025-06-08T21:30:30Z",
"aliases": [
"CVE-2025-35005"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35005"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35005"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:31Z"
}
}
advisories/unreviewed/2025/06/GHSA-pj5v-grmp-4755/GHSA-pj5v-grmp-4755.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pj5v-grmp-4755",
"modified": "2025-06-08T21:30:31Z",
"published": "2025-06-08T21:30:31Z",
"aliases": [
"CVE-2025-35010"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35010"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35010"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-pvmg-5w26-65m7/GHSA-pvmg-5w26-65m7.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pvmg-5w26-65m7",
"modified": "2025-06-08T21:30:30Z",
"published": "2025-06-08T21:30:30Z",
"aliases": [
"CVE-2025-35006"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35006"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35006"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-rf7g-v8g6-48q6/GHSA-rf7g-v8g6-48q6.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rf7g-v8g6-48q6",
"modified": "2025-06-08T21:30:29Z",
"published": "2025-06-08T21:30:29Z",
"aliases": [
"CVE-2025-32457"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32457"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3460"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:31Z"
}
}
advisories/unreviewed/2025/06/GHSA-rmr3-f2f2-5gjh/GHSA-rmr3-f2f2-5gjh.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rmr3-f2f2-5gjh",
"modified": "2025-06-08T21:30:31Z",
"published": "2025-06-08T21:30:31Z",
"aliases": [
"CVE-2025-3460"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3460"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3460"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-wc8m-52qp-mpc9/GHSA-wc8m-52qp-mpc9.json
+48
View File
@@ -0,0 +1,48 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wc8m-52qp-mpc9",
"modified": "2025-06-08T21:30:31Z",
"published": "2025-06-08T21:30:30Z",
"aliases": [
"CVE-2025-35009"
],
"details": "Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). This issue has not been generally fixed at the time of this CVE record's first publishing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35009"
},
{
"type": "WEB",
"url": "https://support.microhardcorp.com/portal/en/kb/articles/ipn4gii-bullet-lte-firmware"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-35009"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/BulletLTE-NA2.php"
},
{
"type": "WEB",
"url": "https://www.microhardcorp.com/IPn4Gii-NA2.php"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:32Z"
}
}
advisories/unreviewed/2025/06/GHSA-wwc6-hv89-4c8g/GHSA-wwc6-hv89-4c8g.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wwc6-hv89-4c8g",
"modified": "2025-06-08T21:30:29Z",
"published": "2025-06-08T21:30:29Z",
"aliases": [
"CVE-2025-32455"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32455"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3460"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:30Z"
}
}
advisories/unreviewed/2025/06/GHSA-x9cq-hh4v-vrww/GHSA-x9cq-hh4v-vrww.json
+40
View File
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x9cq-hh4v-vrww",
"modified": "2025-06-08T21:30:29Z",
"published": "2025-06-08T21:30:29Z",
"aliases": [
"CVE-2025-32459"
],
"details": "The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is an instance of CWE-88, \"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'),\" and is estimated as a CVSS 7.7 ( CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) .\nThis issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32459"
},
{
"type": "WEB",
"url": "https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices"
},
{
"type": "WEB",
"url": "https://takeonme.org/cves/cve-2025-3460"
}
],
"database_specific": {
"cwe_ids": [
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-08T21:15:31Z"
}
}