Marvell QConvergeConsole Directory Traversal Info Disclosure (CVE-2025-6803)

Critical Vulnerability Information Vulnerability Name: (0Day) Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability ZDI ID: ZDI-25-452, ZDI-CAN-24923 CVE ID: CVE-2025-6803 CVSS Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Affected Vendor: Marvell Affected Product: QConvergeConsole Vulnerability Details Description: This vulnerability allows remote attackers to disclose sensitive information on affected Marvell QConvergeConsole installations. Exploitation of this vulnerability does not require authentication. Specific Issue: The issue arises from a specific flaw in the implementation of the compressDriverFiles method, due to the lack of proper validation of user-supplied paths prior to file operations. Additional Details Report Submission: On September 17, 2024, ZDI submitted the report to the vendor. Vendor Acknowledgment: On September 23, 2024, the vendor confirmed receipt of the report. Support Status: On October 9, 2024, the vendor communicated that the product is no longer supported. Mitigation: The vendor no longer supports or recommends this tool. The product has reached end-of-life (EOL) and end-of-support (EOS) status, having been discontinued since the release of v5.5.0.085 in January 2022. Disclosure Timeline Reported to Vendor: September 17, 2024 Coordinated Public Release: June 27, 2025 Announcement Update: June 27, 2025 Acknowledgments Discoverer: Andrea Micalizzi aka rgod (@rgod777)

Goal Reached Thanks to every supporter — we hit 100%!

Marvell QConvergeConsole Directory Traversal Info Disclosure (CVE-2025-6803)