Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability

A directory traversal vulnerability allowing information disclosure and denial-of-service conditions has been identified in Marvell QConvergeConsole. This issue arises in the compressConfigFiles method, where user-supplied paths are not properly validated before being used in file operations. As a result, remote attackers can exploit this vulnerability to access sensitive information or disrupt service. Notably, authentication is not required for exploitation.

Impact

Exploitation of this vulnerability can lead to unauthorized information disclosure and the creation of a denial-of-service condition on the affected system.

Remediation

Marvell QConvergeConsole has reached its End of Life and End of Support status, with the last supported version released in January 2022. The vendor no longer recommends the use of this tool.