Marvell QConvergeConsole Directory Traversal Arbitrary File Deletion Vulnerability

A directory traversal vulnerability allowing arbitrary file deletion has been identified in Marvell QConvergeConsole. This issue arises in the deleteEventLogFile method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can exploit this vulnerability to delete files with SYSTEM privileges. Notably, no authentication is required to carry out this attack.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the affected system, with deleted files potentially being critical to system or application operation.

Remediation

Marvell QConvergeConsole is no longer supported or recommended by the vendor. The product has reached End of Life and End of Support status after version 5.5.0.85 was released in January 2022.