CVE-2025-6798 is a critical (CVSS 9.1) directory traversal in Marvell QConvergeConsole. The deleteAppFile method lets an unauthenticated attacker delete arbitrary files as SYSTEM. The product is end of life and has no patch, so remove it or isolate it from networks.
What's affected
Marvell QConvergeConsole, the management tool for QLogic adapters. The record does not name specific versions. The ZDI advisory says the product entered end of life and end of support after version 5.5.0.85 was released in January 2022, and that the vendor no longer supports or recommends the tool. No patch is listed.
Severity differs by source. The NVD record scores the issue 9.1, critical. The Zero Day Initiative scores it 8.2, with a vector that rates the impact on integrity as low and on availability as high. Both agree that no authentication is required and that files are deleted with SYSTEM rights.
ZDI reports that it submitted the report in September 2024, and that on 9 October 2024 the vendor said the product was out of support.
How to check if you're exposed
Look for the product on Windows servers that manage storage adapters:
Get-Package -Name "*QConvergeConsole*"
Get-Service | Where-Object DisplayName -like "*QConverge*"
If it is installed, check whether its management service listens on the network and whether that port is reachable from user networks:
netstat -ano | findstr LISTENING
Match the process to the QConvergeConsole service. A management console reachable from broad networks is the main exposure.
What to do now
- Find every server with QConvergeConsole installed.
- Uninstall it where it is not needed. The vendor no longer supports it, and no patch exists.
- Where you still need it, block remote access to its management port with a host firewall and allow only a dedicated admin host.
- Use current vendor tooling for adapter management instead, and confirm the replacement with the vendor.
- Make sure backups cover the host, since an arbitrary file deletion can break the system.
Why it matters
The weakness is CWE-22, path traversal. According to ZDI, the deleteAppFile method uses a path supplied by the user in file operations without validating it first. The result is that files outside the intended folder can be removed.
Deleting files as SYSTEM can do real damage even without code execution: removing security tooling, logs or system files can cause outages or hide other activity. The wider lesson is about end of life management software. It stays installed on servers for years because nobody owns it, and it often runs with high privilege and a network listener. A sibling method has the same weakness, CVE-2025-6805. The record does not list this CVE as known exploited.
Quick check
Is there a patch?
No. The ZDI advisory says the product is end of life and the vendor no longer supports it.
Which score should I use?
Record both: the NVD score is 9.1 and ZDI scores it 8.2. Either way the advice is to remove or isolate the product.
Sources
Last reviewed: 18 October 2026.
