- Description
- Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote attackers to disclose sensitive information or to create a denial-of-service condition on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the compressConfigFiles method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information or to create a denial-of-service condition on the system. Was ZDI-CAN-24915.
- Source
- zdi-disclosures@trendmicro.com
- NVD status
- Analyzed
- Products
- qconvergeconsole
CVSS 3.0
- Type
- Secondary
- Base score
- 9.4
- Impact score
- 5.5
- Exploitability score
- 3.9
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
- Severity
- CRITICAL
- zdi-disclosures@trendmicro.com
- CWE-22
- Hype score
- Not currently trending
🚨 New Threat Alert: CVE-2025-8426 🚨 Marvell QConvergeConsole users beware! A critical directory traversal vulnerability allows remote attackers to disclose sensitive info or cause a DoS—no authentication needed! Patch now to stay safe! #CyberSecurity #InfoSec 🔒⚠️
@SecAideInfo
3 Aug 2025
37 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CRITICAL: Marvell QConvergeConsole 5.5.0.78 hit by path traversal flaw (CVE-2025-8426). No auth needed—attackers can leak sensitive data or trigger DoS! Patch ASAP. https://t.co/Baf7eAmSmq #OffSeq #infosec #... https://t.co/Lnyh6ED47j
@offseq
1 Aug 2025
64 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-8426 Unauthenticated Directory Traversal in Marvell QConvergeConsole compressConfigFiles Method https://t.co/JPsGqWFoWd
@VulmonFeeds
31 Jul 2025
5 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-8426 Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote attackers … https://t.co/DriGH4qP6K
@CVEnew
31 Jul 2025
387 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-8426: CRITICAL] Vulnerability in Marvell QConvergeConsole allows attackers to disclose info/Create DoS. No authentication needed. Exploit vulnerability by manipulating paths.#cve,CVE-2025-8426,#cybersecurity https://t.co/APTYP7LruK https://t.co/mletZV6VBP
@CveFindCom
31 Jul 2025
65 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:marvell:qconvergeconsole:5.5.0.85:*:*:*:*:*:*:*",
"matchCriteriaId": "E747F686-5F43-4460-9E4D-8FBC1B9CFF15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]