Marvell QConvergeConsole Directory Traversal Arbitrary File Write Vulnerability

A directory traversal vulnerability allowing arbitrary file writing has been identified in Marvell QConvergeConsole. This issue arises in the decryptFile method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can exploit this vulnerability to create files on the affected system, with the operation running under the SYSTEM context. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary file creation on the affected system, with files being written in the context of the SYSTEM user.

Remediation

Marvell QConvergeConsole is no longer supported or recommended by the vendor. The product has reached its End of Life and End of Support status after version 5.5.0.85 was released in January 2022.