CVE-2025-6793

Published Jul 7, 2025

Last updated 10 months ago

Marvell QConvergeConsole

QLogicDownloadImpl

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6793 is a directory traversal vulnerability found within the QLogicDownloadImpl class of Marvell QConvergeConsole. This flaw allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations. The vulnerability arises from the lack of proper validation of user-supplied paths before they are used in file operations. An attacker can exploit this to manipulate file paths, leading to unauthorized file deletion and information disclosure in the context of the SYSTEM. Authentication is not required to exploit this vulnerability.

Description: Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QLogicDownloadImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files and disclose information in the context of SYSTEM. Was ZDI-CAN-24912.
Source: zdi-disclosures@trendmicro.com
NVD status: Analyzed
Products: qconvergeconsole

Risk scores

CVSS 3.0

Type: Secondary
Base score: 9.4
Impact score: 5.5
Exploitability score: 3.9
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Severity: CRITICAL

Weaknesses

zdi-disclosures@trendmicro.com: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:marvell:qconvergeconsole:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0010943C-4166-4AFD-9976-A488D29C376F",
            "versionEndIncluding": "5.5.0.85",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote attackers to disclose sensitive information or to create a denial-of-service condition on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the compressConfigFiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information or to create a denial-of-service condition on the system. Was ZDI-CAN-24915.•CVE-2025-8426

References

Sources include official advisories and independent security research.