Marvell QConvergeConsole Directory Traversal Vulnerability Leading to Arbitrary File Deletion

A directory traversal vulnerability allowing arbitrary file deletion has been identified in Marvell QConvergeConsole. This issue arises in the deleteAppFile method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can delete files without authentication, with the deletions occurring in the context of the SYSTEM user.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the affected system, with deleted files potentially being critical to the application's operation or the system's integrity.

Remediation

Marvell QConvergeConsole is no longer supported or recommended by the vendor. The product has reached End of Life and End of Support status after version 5.5.0.85 was released in January 2022.