Skip to content

Commit 1b13f0b

Browse files
todbtodb
authored
Stage up a slew of new CVEs, and also fix up the CVE tables a little (#216)
* Note that we wont pre-publish reserved IDs any more Signed-off-by: Tod Beardsley <todb@packetfu.com> * Index new ICS CVEs Signed-off-by: Tod Beardsley <todb@packetfu.com> * Force nowrap on the CVE cell for the table Signed-off-by: Tod Beardsley <todb@packetfu.com> * Fix up wrapping on CVEs, chunk into years Signed-off-by: Tod Beardsley <todb@packetfu.com> * See #216, add deets. Signed-off-by: Tod Beardsley <todb@packetfu.com> --------- Signed-off-by: Tod Beardsley <todb@packetfu.com>
1 parent e4bb469 commit 1b13f0b

16 files changed

+1388
-5
lines changed

‎content/cve.md‎

Lines changed: 51 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,14 @@ For issues involving other parties, please see additional requirements, below. N
9696

9797
When we publish CVEs, we will tend to use this [template], adjusted to taste.
9898

99+
<style>
100+
.nowrap-cve-cell-table td:first-child { white-space: nowrap; }
101+
</style>
102+
103+
### 2023 Disclosures
104+
105+
<div class="nowrap-cve-cell-table">
106+
99107
| CVE | Meeting | Issue |
100108
| ---------------- | --------- | ------------------------------------------ |
101109
| [CVE-2023-0666] | 0x00c7 | **Wireshark RTPS Parsing Buffer Overflow** |
@@ -105,20 +113,43 @@ When we publish CVEs, we will tend to use this [template], adjusted to taste.
105113
| [CVE-2023-2906] | 0x00c8 | **Wireshark CP2179 divide by zero** |
106114
| [CVE-2023-4504] | 0x00c9 | **CUPS/libppd PostScript Parsing Heap Overflow** |
107115
| [CVE-2023-5841] | 0x00cd | **OpenEXR Heap Overflow in Scanline Deep Data Parsing** |
116+
117+
### 2024 Disclosures
118+
119+
| CVE | Meeting | Issue |
120+
| ---------------- | --------- | ------------------------------------------ |
108121
| [CVE-2024-2053] | 0x00d1 | **Artica Proxy Unauthenticated LFI Protection Bypass** |
109122
| [CVE-2024-2054] | 0x00d1 | **Artica Proxy Unauthenticated PHP Deserialization** |
110123
| [CVE-2024-2055] | 0x00d1 | **Artica Proxy Unauthenticated File Manage** |
111124
| [CVE-2024-2056] | 0x00d1 | **Artica Proxy Loopback Services Remotely Accessible Unauthenticated** |
112125
| [CVE-2024-4224] | 0x00d3 | **TP-Link TL-SG1016DE XSS** |
126+
127+
### 2025 Disclosures
128+
129+
| CVE | Meeting | Issue |
130+
| ---------------- | --------- | ------------------------------------------ |
113131
| [CVE-2025-2894] | 0x00de | **Unitree Go1 Backdoor Control Channel** |
132+
| [CVE-2025-3459] | 0x00df | **onsemi Quantenna transmit_file ArgInj** |
133+
| [CVE-2025-3460] | 0x00df | **onsemi Quantenna set_tx_pow ArgInj** |
134+
| [CVE-2025-3461] | 0x00df | **onsemi Quantenna Telent Missing Auth** |
135+
| [CVE-2025-32455] | 0x00df | **onsemi Quantenna router_command run_cmd ArgInj** |
136+
| [CVE-2025-32456] | 0x00df | **onsemi Quantenna router_command put_file_to_qtn ArgInj** |
137+
| [CVE-2025-32457] | 0x00df | **onsemi Quantenna router_command get_file_from_qtn ArgInj** |
138+
| [CVE-2025-32458] | 0x00df | **onsemi Quantenna router_command get_syslog_from_qtn ArgInj** |
139+
| [CVE-2025-32459] | 0x00df | **onsemi Quantenna router_command sync_time ArgInj** |
140+
| [CVE-2025-35004] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MFIP ArgInj** |
141+
| [CVE-2025-35005] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MFMAC ArgInj** |
142+
| [CVE-2025-35006] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MFPORTFWD ArgInj** |
143+
| [CVE-2025-35007] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MFRULE ArgInj** |
144+
| [CVE-2025-35008] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MMNAME ArgInj** |
145+
| [CVE-2025-35009] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MNNETSP ArgInj** |
146+
| [CVE-2025-35010] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MNPINGTM ArgInj** |
147+
148+
</div>
114149

115150
## Reserved CVEs
116151

117-
We've reserved the following CVEs for upcoming publication.
118-
119-
| CVE | Meeting |
120-
| --------------- | --------- |
121-
| None yet! | 0x00xx |
152+
We've reserved some number of CVEs, but it's all quite secretive and sneaky to avoid the dreaded [RBP Goblins](https://cve.mitre.org/cve/cna/RBP_Policy_v1-0.pdf). We'll publish when we publish.
122153

123154
### Contact
124155

@@ -147,3 +178,18 @@ Vulnerabilities involving other parties must be either (1) presented at a regula
147178
[CVE-2024-2056]: https://korelogic.com/Resources/Advisories/KL-001-2024-004.txt
148179
[CVE-2024-4224]: {{< baseurl >}}cves/cve-2024-4224/
149180
[CVE-2025-2894]: {{< baseurl >}}cves/cve-2025-2894/
181+
[CVE-2025-3459]: {{< baseurl >}}cves/cve-2025-3459/
182+
[CVE-2025-3460]: {{< baseurl >}}cves/cve-2025-3460/
183+
[CVE-2025-3461]: {{< baseurl >}}cves/cve-2025-3461/
184+
[CVE-2025-32455]: {{< baseurl >}}cves/cve-2025-32455/
185+
[CVE-2025-32456]: {{< baseurl >}}cves/cve-2025-32456/
186+
[CVE-2025-32457]: {{< baseurl >}}cves/cve-2025-32457/
187+
[CVE-2025-32458]: {{< baseurl >}}cves/cve-2025-32458/
188+
[CVE-2025-32459]: {{< baseurl >}}cves/cve-2025-32459/
189+
[CVE-2025-35004]: {{< baseurl >}}cves/cve-2025-35004/
190+
[CVE-2025-35005]: {{< baseurl >}}cves/cve-2025-35005/
191+
[CVE-2025-35006]: {{< baseurl >}}cves/cve-2025-35006/
192+
[CVE-2025-35007]: {{< baseurl >}}cves/cve-2025-35007/
193+
[CVE-2025-35008]: {{< baseurl >}}cves/cve-2025-35008/
194+
[CVE-2025-35009]: {{< baseurl >}}cves/cve-2025-35009/
195+
[CVE-2025-35010]: {{< baseurl >}}cves/cve-2025-35010/

‎content/cves/CVE-2025-32455.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: CVE-2025-32455
3+
aliases:
4+
- /cves/CVE-2025-32455.html
5+
---
6+
7+
# CVE-2025-32455: ON Semiconductor Quantenna router_command.sh run_cmd Argument Injection
8+
9+
[AHA!] has discovered an issue with Quantenna Wi-Fi chips from ON Semiconductor, and is issuing this disclosure in accordance with AHA!'s standard [disclosure policy] on June 8, 2025. [CVE-2025-32455] has been assigned to this issue.
10+
11+
Any questions about this disclosure should be directed to cve@takeonme.org.
12+
13+
# Executive Summary
14+
15+
Quantenna Wi-Fi chips ship with a local control script that is vulnerable to command injection. This is an instance of [CWE-88](https://cwe.mitre.org/data/definitions/88.html), "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS [7.7](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
16+
17+
# Technical Details
18+
19+
The run_cmd function of the router_command.sh script is vulnerable to command injection. Observe the following code snippet:
20+
21+
```
22+
if [ "$1" == "run_cmd" ] ; then
23+
chmod a+x $2
24+
$2
25+
fi
26+
```
27+
28+
There is no sanitization on the second argument, allowing an attacker to put any command they want in there and it will run. An example of remote exploitation of this vulnerability would be to use the qcsapi rpc service to run the run_script command on the router_command.sh script as follows:
29+
30+
```
31+
qcsapi_sockrpc run_script router_command.sh run_cmd "\`/usr/sbin/inetd\`"
32+
```
33+
34+
This would cause a telnet service to spawn on the affected chip, but the command could be anything and would run as root.
35+
36+
# Attacker Value
37+
38+
Assuming the implementor of the Quantenna Wi-Fi chip has failed to disable the qcsapi rpc service in their end product, an attacker can use this vulnerability to run any command as root, noting especially the ability to enable the telnet service (and thus, chaining this issue with the issue described in [CVE-2025-3461]). This, in turn, can allow the attacker to essentially take complete control of the Quantenna Wi-Fi chip remotely, without authentication.
39+
40+
Note that it may be tricky to identify what end products incorporate this chipset. If you're aware of this chipset in use in your Wi-Fi access point, please feel free to share, as end-users are unlikely to be capable of working around this issue on their own.
41+
42+
# Credit
43+
44+
This vulnerability was discovered and documented by Ricky "HeadlessZeke" Lawshae of Keysight.
45+
46+
# Timeline
47+
48+
* 2025-03-27 (Thu): Presented at regularly scheduled AHA! meeting 0x00df
49+
* 2025-04-02 (Wed): Contact initiated to support@onsemi.com
50+
* 2025-04-08 (Tue): Discovered and contact established with psirt@onsemi.com.
51+
* 2025-04-11 (Fri): Acknowledged by the vendor
52+
* 2025 (April and May): Various communications about this and other discovered issues between AHA! and the vendor
53+
* 2025-05-19 (Mon): Draft best practices report shared with AHA!
54+
* 2025-05-30 (Fri): Best practices guidance [published by the vendor](https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices)
55+
* 2025-06-08 (Sun): Public disclosure of [CVE-2025-32455]
56+
57+
----
58+
59+
[AHA!]: https://takeonme.org
60+
[disclosure policy]: https://takeonme.org/cve.html
61+
[CVE-2025-32455]: https://www.cve.org/CVERecord?id=CVE-2025-32455
62+
[CVE-2025-3461]: https://www.cve.org/CVERecord?id=CVE-2025-3461

‎content/cves/CVE-2025-32456.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
title: CVE-2025-32456
3+
aliases:
4+
- /cves/CVE-2025-32456.html
5+
---
6+
7+
# CVE-2025-32456: ON Semiconductor Quantenna router_command.sh put_file_to_qtn Argument Injection
8+
9+
[AHA!] has discovered an issue with Quantenna Wi-Fi chips from ON Semiconductor, and is issuing this disclosure in accordance with AHA!'s standard [disclosure policy] on June 8, 2025. [CVE-2025-32456] has been assigned to this issue.
10+
11+
Any questions about this disclosure should be directed to cve@takeonme.org.
12+
13+
# Executive Summary
14+
15+
Quantenna Wi-Fi chips ship with a local control script that is vulnerable to command injection. This is an instance of [CWE-88](https://cwe.mitre.org/data/definitions/88.html), "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS [7.7](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
16+
17+
# Technical Details
18+
19+
The put_file_to_qtn function of the router_command.sh script is vulnerable to command injection. Observe the following code snippet:
20+
21+
```
22+
if [ "$1" == "put_file_to_qtn" ] ; then
23+
tftp -g $2 -r $3 -l $4
24+
fi
25+
```
26+
There is no sanitization on the second, third, or fourth argument, allowing an attacker to put any command they want in there and it will run. An example of remote exploitation of this vulnerability would be to use the qcsapi rpc service to run the run_script command on the router_command.sh script as follows:
27+
28+
```
29+
qcsapi_sockrpc run_script router_command.sh put_file_to_qtn "1;/usr/sbin/inetd$IFS#"
30+
```
31+
32+
This would cause a telnet service to spawn on the affected chip, but the command could be anything and would run as root.
33+
34+
# Attacker Value
35+
36+
Assuming the implementor of the Quantenna Wi-Fi chip has failed to disable the qcsapi rpc service in their end product, an attacker can use this vulnerability to run any command as root, noting especially the ability to enable the telnet service (and thus, chaining this issue with the issue described in [CVE-2025-3461]). This, in turn, can allow the attacker to essentially take complete control of the Quantenna Wi-Fi chip remotely, without authentication.
37+
38+
Note that it may be tricky to identify what end products incorporate this chipset. If you're aware of this chipset in use in your Wi-Fi access point, please feel free to share, as end-users are unlikely to be capable of working around this issue on their own.
39+
40+
# Credit
41+
42+
This vulnerability was discovered and documented by Ricky "HeadlessZeke" Lawshae of Keysight.
43+
44+
# Timeline
45+
46+
* 2025-03-27 (Thu): Presented at regularly scheduled AHA! meeting 0x00df
47+
* 2025-04-02 (Wed): Contact initiated to support@onsemi.com
48+
* 2025-04-08 (Tue): Discovered and contact established with psirt@onsemi.com.
49+
* 2025-04-11 (Fri): Acknowledged by the vendor
50+
* 2025 (April and May): Various communications about this and other discovered issues between AHA! and the vendor
51+
* 2025-05-19 (Mon): Draft best practices report shared with AHA!
52+
* 2025-05-30 (Fri): Best practices guidance [published by the vendor](https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices)
53+
* 2025-06-08 (Sun): Public disclosure of [CVE-2025-32456]
54+
55+
----
56+
57+
[AHA!]: https://takeonme.org
58+
[disclosure policy]: https://takeonme.org/cve.html
59+
[CVE-2025-32456]: https://www.cve.org/CVERecord?id=CVE-2025-32456
60+
[CVE-2025-3461]: https://www.cve.org/CVERecord?id=CVE-2025-3461

‎content/cves/CVE-2025-32457.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
title: CVE-2025-32457
3+
aliases:
4+
- /cves/CVE-2025-32457.html
5+
---
6+
7+
# CVE-2025-32457: ON Semiconductor Quantenna router_command.sh get_file_from_qtn Argument Injection
8+
9+
[AHA!] has discovered an issue with Quantenna Wi-Fi chips from ON Semiconductor, and is issuing this disclosure in accordance with AHA!'s standard [disclosure policy] on June 8, 2025. [CVE-2025-32457] has been assigned to this issue.
10+
11+
Any questions about this disclosure should be directed to cve@takeonme.org.
12+
13+
# Executive Summary
14+
15+
Quantenna Wi-Fi chips ship with a local control script that is vulnerable to command injection. This is an instance of [CWE-88](https://cwe.mitre.org/data/definitions/88.html), "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS [7.7](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
16+
17+
# Technical Details
18+
19+
The get_file_from_qtn function of the router_command.sh script is vulnerable to command injection. Observe the following code snippet:
20+
21+
```if [ "$1" == "get_file_from_qtn" ] ; then
22+
tftp -p $2 -r $4 -l $3
23+
fi
24+
```
25+
26+
There is no sanitization on the second, third, or fourth argument, allowing an attacker to put any command they want in there and it will run. An example of remote exploitation of this vulnerability would be to use the qcsapi rpc service to run the run_script command on the router_command.sh script as follows:
27+
28+
```
29+
qcsapi_sockrpc run_script router_command.sh get_file_from_qtn "1;/usr/sbin/inetd$IFS#"
30+
```
31+
32+
This would cause a telnet service to spawn on the affected chip, but the command could be anything and would run as root.
33+
34+
# Attacker Value
35+
36+
Assuming the implementor of the Quantenna Wi-Fi chip has failed to disable the qcsapi rpc service in their end product, an attacker can use this vulnerability to run any command as root, noting especially the ability to enable the telnet service (and thus, chaining this issue with the issue described in [CVE-2025-3461]). This, in turn, can allow the attacker to essentially take complete control of the Quantenna Wi-Fi chip remotely, without authentication.
37+
38+
Note that it may be tricky to identify what end products incorporate this chipset. If you're aware of this chipset in use in your Wi-Fi access point, please feel free to share, as end-users are unlikely to be capable of working around this issue on their own.
39+
40+
# Credit
41+
42+
This vulnerability was discovered and documented by Ricky "HeadlessZeke" Lawshae of Keysight.
43+
44+
# Timeline
45+
46+
* 2025-03-27 (Thu): Presented at regularly scheduled AHA! meeting 0x00df
47+
* 2025-04-02 (Wed): Contact initiated to support@onsemi.com
48+
* 2025-04-08 (Tue): Discovered and contact established with psirt@onsemi.com.
49+
* 2025-04-11 (Fri): Acknowledged by the vendor
50+
* 2025 (April and May): Various communications about this and other discovered issues between AHA! and the vendor
51+
* 2025-05-19 (Mon): Draft best practices report shared with AHA!
52+
* 2025-05-30 (Fri): Best practices guidance [published by the vendor](https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices)
53+
* 2025-06-08 (Sun): Public disclosure of [CVE-2025-32457]
54+
55+
----
56+
57+
[AHA!]: https://takeonme.org
58+
[disclosure policy]: https://takeonme.org/cve.html
59+
[CVE-2025-32457]: https://www.cve.org/CVERecord?id=CVE-2025-32457
60+
[CVE-2025-3461]: https://www.cve.org/CVERecord?id=CVE-2025-3461

‎content/cves/CVE-2025-32458.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: CVE-2025-32458
3+
aliases:
4+
- /cves/CVE-2025-32458.html
5+
---
6+
7+
# CVE-2025-32458: ON Semiconductor Quantenna router_command.sh get_syslog_from_qtn Argument Injection
8+
9+
[AHA!] has discovered an issue with Quantenna Wi-Fi chips from ON Semiconductor, and is issuing this disclosure in accordance with AHA!'s standard [disclosure policy] on June 8, 2025. [CVE-2025-32458] has been assigned to this issue.
10+
11+
Any questions about this disclosure should be directed to cve@takeonme.org.
12+
13+
# Executive Summary
14+
15+
Quantenna Wi-Fi chips ship with a local control script that is vulnerable to command injection. This is an instance of [CWE-88](https://cwe.mitre.org/data/definitions/88.html), "Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')," and is estimated as a CVSS [7.7](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
16+
17+
# Technical Details
18+
19+
The get_syslog_from_qtn function of the router_command.sh script is vulnerable to command injection. Observe the following code snippet:
20+
21+
```if [ "$1" == "get_syslog_from_qtn" ] ; then
22+
logmsg -t time `uptime`
23+
logmsg -t time `date`
24+
tftp -p $2 -r syslog.qtn -l /tmp/syslog.log
25+
fi
26+
```
27+
28+
There is no sanitization on the second argument, allowing an attacker to put any command they want in there and it will run. An example of remote exploitation of this vulnerability would be to use the qcsapi rpc service to run the run_script command on the router_command.sh script as follows:
29+
30+
```
31+
qcsapi_sockrpc run_script router_command.sh get_syslog_from_qtn "1;/usr/sbin/inetd$IFS#"
32+
```
33+
34+
This would cause a telnet service to spawn on the affected chip, but the command could be anything and would run as root.
35+
36+
# Attacker Value
37+
38+
Assuming the implementor of the Quantenna Wi-Fi chip has failed to disable the qcsapi rpc service in their end product, an attacker can use this vulnerability to run any command as root, noting especially the ability to enable the telnet service (and thus, chaining this issue with the issue described in [CVE-2025-3461]). This, in turn, can allow the attacker to essentially take complete control of the Quantenna Wi-Fi chip remotely, without authentication.
39+
40+
Note that it may be tricky to identify what end products incorporate this chipset. If you're aware of this chipset in use in your Wi-Fi access point, please feel free to share, as end-users are unlikely to be capable of working around this issue on their own.
41+
42+
# Credit
43+
44+
This vulnerability was discovered and documented by Ricky "HeadlessZeke" Lawshae of Keysight.
45+
46+
# Timeline
47+
48+
* 2025-03-27 (Thu): Presented at regularly scheduled AHA! meeting 0x00df
49+
* 2025-04-02 (Wed): Contact initiated to support@onsemi.com
50+
* 2025-04-08 (Tue): Discovered and contact established with psirt@onsemi.com.
51+
* 2025-04-11 (Fri): Acknowledged by the vendor
52+
* 2025 (April and May): Various communications about this and other discovered issues between AHA! and the vendor
53+
* 2025-05-19 (Mon): Draft best practices report shared with AHA!
54+
* 2025-05-30 (Fri): Best practices guidance [published by the vendor](https://community.onsemi.com/s/article/QCS-Quantenna-Wi-Fi-product-support-and-security-best-practices)
55+
* 2025-06-08 (Sun): Public disclosure of [CVE-2025-32458]
56+
57+
----
58+
59+
[AHA!]: https://takeonme.org
60+
[disclosure policy]: https://takeonme.org/cve.html
61+
[CVE-2025-32458]: https://www.cve.org/CVERecord?id=CVE-2025-32458
62+
[CVE-2025-3461]: https://www.cve.org/CVERecord?id=CVE-2025-3461

0 commit comments

Comments
 (0)