CVE-2025-35009

Affected products: Microhard BulletLTE-NA2 and IPn4Gii-NA2. Issue: post-authentication command injection in the AT+MNNETSP command leading to privilege escalation. Root cause: CWE-88 (Improper Neutralization of Argument Delimiters in a Command). CVSSv3.1 base score 7.1 (Low/Local access, Low priv...

CVE-2025-35007 Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument Injection

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argume...

CVE-2025-32459 ON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the synctime argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2025-32459 ON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the synctime argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2025-32459

The CVE-2025-32459 entry concerns the Quantenna Wi‑Fi chipset where the local control script router_command.sh, used in the sync_time argument, is vulnerable to command injection (CWE-88). Affected product: Quantenna Wi‑Fi chipset up to SDK version 8.0.0.28. Root cause: improper neutralization of...

CVE-2025-32458 ON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the getsyslogfromqtn argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS...

CVE-2025-32458

The CVE-2025-32458 entry affects Quantenna Wi‑Fi chipset firmware (through version 8.0.0.28 of the latest SDK). The local control script router_command.sh (in the get_syslog_from_qtn argument) is vulnerable to command injection (CWE-88). The issue is described as LOCAL, with LOW privileges, NONE ...

CVE-2025-32457

The CVE-2025-32457 entry concerns the Quantenna Wi‑Fi chipset and details a command injection in a local control script. Affected component: router_command.sh (in the get_file_from_qtn argument) and related script paths, with root cause identified as CWE-88 (Improper Neutralization of Argument De...

CVE-2025-32457 ON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the getfilefromqtn argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS...

CVE-2025-32456 ON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the putfiletoqtn argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS...

CVE-2025-32455 ON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the runcmd argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2025-32455

The CVE-2025-32455 family concerns the Quantenna Wi‑Fi chipset. A local control script vulnerability exists in router_command.sh (run_cmd argument), enabling command injection (CWE-88) with CVSS 3.1: Local, Low/None privileges and High impact on confidentiality and integrity (A: High, I: High, C:...

CVE-2025-32455 ON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the runcmd argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2025-3459

The CVE refers to the Quantenna Wi‑Fi chipset where the local control script transmit_file is vulnerable to command injection (CWE-88). Affected products include Quantenna Wi‑Fi chipset up to version 8.0.0.28 of the latest SDK. The issue is described with CVSS 7.7–7.8 metrics (LOCAL attacker, low...

CVE-2025-3459 ON Semiconductor Quantenna transmit_file Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, transmitfile, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2025-3459 ON Semiconductor Quantenna transmit_file Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, transmitfile, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS 7.7...

CVE-2024-3367

Argument injection in webspheremq agent plugin in Checkmk 2.0.0, 2.1.0, 2.2.0p26 and 2.3.0b5 allows local attacker to inject one argument to runmqsc...

CVE-2024-7573

The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient validation of input supplied via POST data in the 'search' function. This makes it possible for unauthenticated attackers to inject...

CVE-2024-21533

All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone API, which allows specifying the remote URL to clone and the file on disk to clone to. The library does not sanitize for user input or validate a given URL scheme, nor does it properly pass command-line...

CVE-2024-31966

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct an argument injection attack due to insufficient paramete...