CVE-2025-6805 is a critical (CVSS 9.1) directory traversal in Marvell QConvergeConsole. The deleteEventLogFile method lets an unauthenticated attacker delete arbitrary files as SYSTEM. The product is end of life and has no patch, so remove it or isolate it from networks.
What's affected
Marvell QConvergeConsole, the management tool for QLogic adapters. The record does not name specific versions. The ZDI advisory says the product entered end of life and end of support after version 5.5.0.85 was released in January 2022, and that the vendor no longer supports or recommends the tool. No patch is listed.
Severity differs by source. The NVD record scores the issue 9.1, critical. The Zero Day Initiative scores it 8.2, with a vector that rates the impact on integrity as low and on availability as high. Both agree that no authentication is required and that files are deleted with SYSTEM rights.
ZDI reports that it submitted the report in September 2024, and that on 9 October 2024 the vendor said the product was out of support.
How to check if you're exposed
Look for the product on Windows servers that manage storage adapters:
Get-Package -Name "*QConvergeConsole*"
Get-Service | Where-Object DisplayName -like "*QConverge*"
If it is installed, check whether its management service listens on the network and whether that port is reachable from user networks:
netstat -ano | findstr LISTENING
Match the process to the QConvergeConsole service. A management console reachable from broad networks is the main exposure.
What to do now
- Find every server with QConvergeConsole installed.
- Uninstall it where it is not needed. The vendor no longer supports it, and no patch exists.
- Where you still need it, block remote access to its management port with a host firewall and allow only a dedicated admin host.
- Use current vendor tooling for adapter management instead, and confirm the replacement with the vendor.
- Make sure backups cover the host, since an arbitrary file deletion can break the system.
Why it matters
The weakness is CWE-22, path traversal. The ZDI advisory says the deleteEventLogFile method uses a user supplied path in file operations without proper validation, which lets the caller reach files outside the log folder.
A method meant to remove old event logs becomes a way to remove anything the service account can reach, and here that account is SYSTEM. Because deleting logs is also a way to cover tracks, a flaw like this has a second use beyond causing damage. The sibling flaw in a different method is CVE-2025-6798. The record does not list this CVE as known exploited.
Quick check
How is this different from CVE-2025-6798?
Same product and same weakness class, but a different method, deleteEventLogFile instead of deleteAppFile.
Why does the end of life status matter?
No patch will come. The only real fixes are removal or isolation.
Sources
Last reviewed: 18 October 2026.
