CVE-2025-6802 CRITICAL

CVE-2025-6802: Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability

Vendor Marvell
Product QConvergeConsole
Weakness CWE-434 · Unrestricted file upload
Published July 7, 2025
Last update July 7, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the getFileFromURL method. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-24922.

Key dates

02Disclosure timeline

July 7, 2025 CVE published
July 7, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-5185 Gym Management System Project v1.0 - Insecure File Upload CVE-2025-0346 code-projects Content Management System Publish News Page publishnews.php unrestricted upload CVE-2024-34416 WordPress Pk Favicon Manager plugin <= 2.1 - Arbitrary File Upload vulnerability CVE-2024-8918 File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload CVE-2025-53283 WordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerability