Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-6807— Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability

EPSS 2.23% · P85
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-6807

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the getDriverTmpPath method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-24980.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Marvell QConvergeConsole 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Marvell QConvergeConsole是美国Marvell公司的一款跨数据中心的统一适配器管理软件。 Marvell QConvergeConsole存在路径遍历漏洞，该漏洞源于getDriverTmpPath方法未正确验证用户提供路径，可能导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
MarvellQConvergeConsole 5.5.0.78 -

II. Public POCs for CVE-2025-6807

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-6807

请登录查看更多情报信息。

Same Patch Batch · Marvell · 2025-07-07 · 15 CVEs total

CVE-2025-6796Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulner
CVE-2025-6806Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerabilit
CVE-2025-6801Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vuln
CVE-2025-6795Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vuln
CVE-2025-6793Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion an
CVE-2025-6797Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vul
CVE-2025-6803Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vu
CVE-2025-6805Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vu
CVE-2025-6794Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerabilit
CVE-2025-6800Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure V
CVE-2025-6802Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vul
CVE-2025-6798Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnera
CVE-2025-6804Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclos
CVE-2025-6799Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vul

IV. Related Vulnerabilities

Same product: QConvergeConsole
Same vendor: Marvell
Same weakness: CWE-22

V. Comments for CVE-2025-6807

No comments yet

Leave a comment