CVE-2025-6793: exploitation status and patch state

CVE-2025-6793 · CVSS 9.4 CRITICAL · EPSS 12%

Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows remote attackers to delete arbitrary files and disclose sensitive information on affected installations of Marvell QConvergeConsole. Authentication is not required to exploit this vulnerability. The specific flaw exists within the QLogicDownloadImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files and disclose information in the context of SYSTEM. Was ZDI-CAN-24912.

Is CVE-2025-6793 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 12%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-6793

• Metasploit Modules Turn Old CVEs Into Routine Targets (2026-05-16)

Primary sources

• NVD record

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.