CVE-2020-5804
📋 TL;DR
This path traversal vulnerability in Marvell QConvergeConsole GUI allows authenticated remote attackers to delete arbitrary files with SYSTEM/root privileges. It affects versions up to 5.5.0.74. Organizations using this management console for Marvell storage products are at risk.
💻 Affected Systems
- Marvell QConvergeConsole GUI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via deletion of critical system files, leading to service disruption, data loss, or privilege escalation to full system control.
Likely Case
Targeted deletion of configuration files, logs, or application data causing service outages or operational disruption.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent unauthorized access to the management interface.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 5.5.0.74
Vendor Advisory: https://www.marvell.com/support/security-advisories.html
Restart Required: Yes
Instructions:
1. Download latest version from Marvell support portal. 2. Backup current configuration. 3. Install update following vendor documentation. 4. Restart QConvergeConsole service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to QConvergeConsole management interface to trusted networks only.
Authentication Hardening
allImplement strong authentication policies and monitor for suspicious login attempts.
🧯 If You Can't Patch
- Implement strict network access controls to limit console access to essential personnel only.
- Enable detailed logging and monitor for file deletion events in system logs.
🔍 How to Verify
Check if Vulnerable:
Check QConvergeConsole version via web interface or configuration files. Versions <= 5.5.0.74 are vulnerable.Check Version:
Check web interface or consult installation documentation for version information.Verify Fix Applied:
Verify installed version is > 5.5.0.74 and test that path traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in system logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual traffic patterns to QConvergeConsole management port
- Requests containing path traversal sequences
SIEM Query:
source="qconvergeconsole" AND (event="file_delete" OR event="authentication")