ZDI-CAN-24912: ZDI-25-450: (0Day) Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QLogicDownloadImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files and disclose information in the context of SYSTEM.
Other sources
This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.4. The following CVEs are assigned: CVE-2025-6793.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-24912?
ZDI-CAN-24912 is a critical vulnerability that allows remote attackers to delete arbitrary files without authentication.
How do I fix ZDI-CAN-24912?
To mitigate ZDI-CAN-24912, update the Marvell QConvergeConsole software to the latest version provided by the vendor.
What kind of information can be disclosed due to ZDI-CAN-24912?
ZDI-CAN-24912 can lead to the disclosure of sensitive information through unauthorized file deletion.
Is authentication required to exploit ZDI-CAN-24912?
No, ZDI-CAN-24912 can be exploited without requiring authentication.
Which software is affected by ZDI-CAN-24912?
Marvell QConvergeConsole is the affected software regarding the ZDI-CAN-24912 vulnerability.