CVE-2020-15645 is a critical remote code execution vulnerability affecting Marvell QConvergeConsole 5.5.0.64. It stems from improper path validation in the getFileFromURL method, allowing authenticated attackers to execute arbitrary code with SYSTEM privileges, despite an authentication bypass mechanism existing. With a CVSS score of 8.8 (High), this vulnerability can be exploited over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed in CISA's KEV catalog, nor does it show significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.5.00.73CPE matchmatch criteria | cpe:2.3:a:marvell:qconvergeconsole:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020Marvell QConvergeConsole GUI Multiple Vulnerabilities
Sep 25, 2020