Marvell QConvergeConsole (QLogic Fibre Channel / FC-NVMe / CNA HBA management web console), 5.5.0.78 and earlier

Impact

A 2025 batch of sixteen ZDI advisories against the same Tomcat/GWT console, most of them reachable with no authentication at all. getFileFromURL gives unrestricted file upload leading to code execution as the console's service account (SYSTEM or root); saveAsText gives directory-traversal RCE; the rest are arbitrary file write, arbitrary file deletion and arbitrary file read. QConvergeConsole is the box that flashes QLogic HBA firmware and boot-from-SAN parameters across the fleet, so owning it means owning the HBA firmware and the SAN login identity of every server it manages - a persistence layer beneath the tenant OS, and a way to re-point a node's boot LUN. The file-deletion variants alone are a fleet availability event.

Who can reach it

Any host that can reach the QConvergeConsole web listener (typically TCP 8080/8443 on a management server or on individual hosts running the agent). No credentials for the unauthenticated set; the older 2020 cluster's 'authenticated' variants were shown to be reachable by bypassing the console's own auth.

What to do

Upgrade to the fixed Marvell QConvergeConsole release, but treat that as a stopgap: this codebase has now produced two large unauthenticated-RCE clusters (2020 and 2025) and has no meaningful hardening. The durable fix for a GPU fleet is to remove QConvergeConsole from production hosts entirely and manage QLogic HBAs with the qaucli/qlogic CLI driven from configuration management, then firewall the console port. Software-only change, no HBA flash and no array downtime. Any host whose console was internet- or tenant-reachable should have its HBA firmware reflashed from a known-good vendor image before reuse.

References