Sivathmican Sivakumaran

**Name of the Vulnerable Software and Affected Versions** Marvell QConvergeConsole version 5.5.0.64 **Description** This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tomcat configuration file due to the lack of proper restriction to the Tomcat admin console. An attacker can leverage this issue to execute code in the context of SYSTEM. **Recommendations** For Marvell QConvergeConsole version 5.5.0.64, restrict access to the Tomcat admin console to minimize the risk of exploitation. Consider implementing proper restrictions to the Tomcat configuration file as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: NEC ESMPRO Manager version 6.42 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the RMI service, resulting from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this issue to execute code in the context of SYSTEM. Recommendations: For NEC ESMPRO Manager version 6.42, consider disabling the RMI service until a patch is available to prevent exploitation. Restrict access to the RMI service to minimize the risk of remote code execution. At the moment, there is no information about a newer version that contains a fix for this issue.