CVE-2025-3461CWE-306

ON Semiconductor Quantenna Telnet Missing Authentication

Critical · published June 8, 2025

CVSS v3.1
9.1
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

🚨 An unauthenticated telnet interface is the gateway — Quantenna Wi-Fi chips are shipped with this security blunder by default! 🔥 Think of it as a coffee shop leaving the back door wide open — anyone can just waltz in without a key and access everything inside. Unfortunately, this is exactly what happens with these Wi-Fi chipsets, allowing anyone to connect and take control without any verification. An attacker could exploit this flaw to gain full control over the device, potentially accessing sensitive data or manipulating the device's settings, which could lead to network breaches or disruptions. This oversight makes it alarmingly easy for malicious individuals to compromise the security and privacy of users connected to affected Wi-Fi networks.

Put simply

Think of it as a coffee shop leaving the back door wide open — anyone can just waltz in without a key and access everything inside. Unfortunately, this is exactly what happens with these Wi-Fi chipsets, allowing anyone to connect and take control without any verification. The vulnerability stems from an unauthenticated telnet interface that allows unauthorized users to interact with the Quantenna Wi-Fi chips. Since there's no authentication required, attackers can send commands directly to the device and potentially take complete control over it.

What to do

An attacker could exploit this flaw to gain full control over the device, potentially accessing sensitive data or manipulating the device's settings, which could lead to network breaches or disruptions. This oversight makes it alarmingly easy for malicious individuals to compromise the security and privacy of users connected to affected Wi-Fi networks. To remediate this issue, implement authentication mechanisms for the telnet interface, and consider disabling telnet altogether if possible. Follow the vendor's best practices guide and update to the latest firmware whenever it becomes available to ensure enhanced security. You've got this! Secure your devices, follow the guidelines, and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.5th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-06-08T21:02Z
EPSS history
Timeline
  • 08 JUN 21:02Z
    ON Semiconductor Quantenna Telnet Missing Authentication
    cvelistv5