How severe is CVE-2025-3461?

CVE-2025-3461 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-3461 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (39th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-3461?

CVE-2025-3461 primarily affects Onsemi Qhs710 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-3461?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-3461 have an EU (EUVD) identifier?

Yes. CVE-2025-3461 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-17410.

When was CVE-2025-3461 published?

CVE-2025-3461 was published on 2025-06-08 and last updated on 2026-06-17.

CVE-2025-3461

CVE-2025-3461 is a critical-severity vulnerability in Onsemi Qhs710 Firmware with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 1% (39th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-17410
Weakness: CWE-306
Affected product: Onsemi Qhs710 Firmware
Published: 2025-06-08
Last modified: 2026-06-17

Description

The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.

Frequently asked questions

What is CVE-2025-3461?: The Quantenna Wi-Fi chips ship with an unauthenticated telnet interface by default. This is an instance of CWE-306, "Missing Authentication for Critical Function," and is estimated as a CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). This issue affects Quantenna Wi-Fi chipset through version 8.0.0.28 of the latest SDK, and appears to be unpatched at the time of this CVE record's first publishing, though the vendor has released a best practices guide for implementors of this chipset.
How severe is CVE-2025-3461?: CVE-2025-3461 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-3461 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (39th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-3461?: CVE-2025-3461 primarily affects Onsemi Qhs710 Firmware. In total, 18 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-3461?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-3461 have an EU (EUVD) identifier?: Yes. CVE-2025-3461 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-17410.
When was CVE-2025-3461 published?: CVE-2025-3461 was published on 2025-06-08 and last updated on 2026-06-17.

References

Affected products (18)

cpe:2.3:o:onsemi:qhs710_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10ga_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qsr10gu_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv840c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv860_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv940_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv942c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qv952c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax3-s5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-a12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t12_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qcs-ax2-t8_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:onsemi:qd840_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Onsemi Qhs710 Firmware

CVE-2025-3460 — High (CVSS 7.7): The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection.…
CVE-2025-3459 — High (CVSS 7.7): The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection.…
CVE-2025-32459 — High (CVSS 7.7): The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is…
CVE-2025-32458 — High (CVSS 7.7): The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument),…
CVE-2025-32457 — High (CVSS 7.7): The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument),…
CVE-2025-32456 — High (CVSS 7.7): The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument),…

All CVEs affecting Onsemi Qhs710 Firmware →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-54309 — Critical (CVSS 10.0): n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP…
CVE-2026-50242 — Critical (CVSS 10.0): In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429…
CVE-2026-49257 — Critical (CVSS 10.0): mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1…
CVE-2026-46846 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46803 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework).…
CVE-2026-46800 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →