Marvell QConvergeConsole Unrestricted File Upload Leading to Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Marvell QConvergeConsole. This issue arises from the 'getFileFromURL' method, which lacks proper validation of user-supplied data, allowing for the upload of arbitrary files. Exploitation of this vulnerability enables remote attackers to execute code with SYSTEM privileges. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the SYSTEM user.

Remediation

Marvell QConvergeConsole is no longer supported or recommended by the vendor. The product has reached End of Life and End of Support status after version 5.5.0.85 was released in January 2022.