Marvell QConvergeConsole Directory Traversal Information Disclosure Vulnerability

A directory traversal vulnerability allowing information disclosure has been identified in Marvell QConvergeConsole. This issue arises in the restoreESwitchConfig method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can exploit this vulnerability to access sensitive information in the context of the SYSTEM user. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of sensitive information.

Remediation

Marvell QConvergeConsole has reached its End of Life and End of Support status, with the last supported version being 5.5.0.85, released in January 2022. The vendor no longer supports or recommends this tool.