ZDI-25-462: (0Day) Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability
This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the decryptFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of SYSTEM.
Other sources
This vulnerability allows remote attackers to create arbitrary files on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.2. The following CVEs are assigned: CVE-2025-6806.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Marvell QConvergeConsoleto a version that resolves this vulnerability.Patch ZDI-25-462 - Compensating control
Since authentication is not required to exploit the vulnerability, restrict network access to the Marvell QConvergeConsole service (e.g., via firewall/ACL) so only trusted clients can reach it.
Event History
Frequently Asked Questions
What is the severity of ZDI-25-462?
The severity of ZDI-25-462 is considered critical due to the potential for remote attackers to create arbitrary files without authentication.
How do I fix ZDI-25-462?
To mitigate ZDI-25-462, users should apply patches provided by Marvell for the QConvergeConsole as soon as they are available.
Who is affected by ZDI-25-462?
ZDI-25-462 affects installations of Marvell QConvergeConsole that are exposed to the internet or unsecured networks.
Can ZDI-25-462 be exploited without authentication?
Yes, ZDI-25-462 can be exploited without any form of authentication, making it more dangerous.
What type of vulnerability is ZDI-25-462?
ZDI-25-462 is a file creation vulnerability that allows remote code execution due to improper handling in the decryptFile method.