CVE-2020-15643: Marvell QConvergeConsole path traversal in saveAsText enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated code execution as SYSTEM with a public exploit and very high EPSS, but no confirmed KEV or ransomware use.

What it is

Marvell QConvergeConsole 5.5.0.64 fails to validate a user-supplied path in the saveAsText method of GWTTestServiceImpl, allowing path traversal that leads to arbitrary file operations. Because the flaw can be reached remotely and the existing authentication mechanism can be bypassed, an unauthenticated attacker can write files and execute code as SYSTEM. The vendor has published an advisory and a public exploit write-up exists, so this is a serious risk for exposed installations.

Impact

An attacker gains arbitrary code execution with SYSTEM privileges on the affected QConvergeConsole host, giving full control of the appliance and any credentials or management data it holds.

Attack surface

The flaw is network-reachable via the QConvergeConsole web interface (CVSS AV:N, AC:L, UI:N). Although the product requires authentication, the record states the authentication mechanism can be bypassed, so no valid credentials are needed; no user interaction is required.

Exploitation

CVE-2020-15643 is not listed in CISA KEV, but EPSS is very high (0.58653, 99.06th percentile) and a public exploit reference (Tenable TRA-2020-56) is present, indicating mature, likely weaponized exploit code.

What to do

• Apply the Marvell fibre-channel security advisory 2020-07 fix or upgrade QConvergeConsole beyond 5.5.0.64; patch first.
• Remove QConvergeConsole from direct internet exposure and restrict management access to trusted admin networks or VPN.
• Enforce strong authentication and review the authentication bypass path; do not rely on the built-in mechanism alone.
• Monitor and restrict file write paths used by the application, and run the service with least privilege where the product allows.
• Audit for unauthorized files or web shells in application and system directories.

Detection

• Monitor QConvergeConsole logs and web server access logs for requests to GWTTestServiceImpl or saveAsText endpoints, especially with path traversal sequences.
• Alert on unexpected file creation or modification in application, web root, and system directories on QConvergeConsole hosts.
• Hunt for new or modified executables, scripts, or web shells and for child processes spawned by the QConvergeConsole service.
• Correlate authentication bypass attempts or anomalous session behavior with subsequent file write activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.