CVE-2025-6799 in QConvergeConsole
Summary
by MITRE • 07/07/2025
Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the getFileUploadBytes method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24919.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This directory traversal vulnerability in Marvell QConvergeConsole represents a critical security flaw that enables unauthenticated remote attackers to access sensitive system information. The vulnerability stems from insufficient input validation within the getFileUploadBytes method, which processes user-supplied file paths without adequate sanitization or verification. This weakness allows malicious actors to manipulate file access operations and potentially read arbitrary files from the system filesystem. The vulnerability specifically affects installations where the QConvergeConsole application is deployed, creating a persistent risk for organizations relying on this network management platform.
The technical implementation flaw resides in how the application handles user-provided path parameters during file upload operations. When the getFileUploadBytes method processes incoming requests, it fails to validate or sanitize the supplied file paths before executing file system operations. This lack of input validation creates an exploitable condition where attackers can craft malicious requests containing directory traversal sequences such as "../" or similar path manipulation techniques. The vulnerability operates at a fundamental level within the application's file handling mechanism, bypassing normal access controls and security boundaries that should protect sensitive system files.
The operational impact of this information disclosure vulnerability extends beyond simple data exposure, as it allows attackers to potentially access system-level files with elevated privileges. Since exploitation requires no authentication credentials, the vulnerability presents an immediate threat to all affected installations. An attacker can leverage this condition to gain insights into the underlying system configuration, potentially identifying sensitive information such as system paths, file structures, or even credential storage locations. The vulnerability's ability to operate in the SYSTEM context means that successful exploitation could provide access to critical system resources and potentially enable further compromise of the affected environment.
Organizations should implement immediate mitigations including network segmentation to restrict access to QConvergeConsole applications, deployment of web application firewalls to filter malicious requests, and application-level input validation to prevent path traversal attempts. The vulnerability aligns with CWE-22 Directory Traversal and follows patterns commonly associated with ATT&CK technique T1083 File and Directory Discovery. Security teams should conduct comprehensive vulnerability assessments across all network management systems and implement proper access controls to limit exposure to such attacks. Regular security updates and patch management processes become critical for maintaining protection against similar vulnerabilities in network infrastructure applications.