Marvell QConvergeConsole Directory Traversal Information Disclosure Vulnerability

A directory traversal vulnerability allowing information disclosure has been identified in Marvell QConvergeConsole. This issue arises in the getAppFileBytes method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can exploit this vulnerability to access sensitive information, with the exploitation occurring in the context of the SYSTEM user. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of sensitive information.

Remediation

Marvell QConvergeConsole is no longer supported or recommended by the vendor. The product has reached End of Life (EOL) and End of Support (EOS) status after version 5.5.0.85 was released in January 2022.