CVE-2025-6800

Executive Summary

CVE-2025-6800 is a critical directory traversal vulnerability in Marvell QConvergeConsole, specifically within the restoreESwitchConfig method. The flaw allows an unauthenticated remote attacker to read arbitrary files on the underlying Windows system, potentially exposing sensitive configuration data, credentials, or other secrets. The vulnerability is classified as an information disclosure (CWE-22) with a CVSS score of 7.5 (High). No public exploit code or proof-of-concept is currently available, and no official patch has been released by Marvell. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the lack of authentication requirements and the potential for SYSTEM-level file access.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial-of-service impact.

CVSS Score: 7.5 (High)
Threat Level: High – Unauthenticated remote file read with SYSTEM privileges.

Deep Dive & Mechanics

The vulnerability resides in the restoreESwitchConfig method of Marvell QConvergeConsole. This method is intended to restore switch configuration from a user-supplied file path. However, the implementation fails to validate or sanitize the path provided by the attacker. By supplying a path containing directory traversal sequences (e.g., ../../../windows/system32/config/sam), an attacker can force the application to read arbitrary files outside the intended directory.

The application runs with SYSTEM privileges, meaning any file on the Windows filesystem can be read, including:

• SAM and SYSTEM registry hives (password hashes)
• Configuration files containing credentials
• Application logs and debug files
• Other sensitive system files

The attack does not require authentication, making it trivially exploitable if the QConvergeConsole service is exposed to the network. The lack of input validation on the file path is the root cause, and the high privilege level of the service amplifies the impact.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def restoreESwitchConfig(self, file_path):
    # No validation of file_path
    with open(file_path, 'r') as f:
        config_data = f.read()
    # Process config_data...

Patched Code (Conceptual):

import os

def restoreESwitchConfig(self, file_path):
    # Resolve and restrict to allowed directory
    allowed_dir = "C:\\ProgramData\\Marvell\\QConvergeConsole\\configs\\"
    full_path = os.path.abspath(os.path.join(allowed_dir, file_path))
    if not full_path.startswith(allowed_dir):
        raise PermissionError("Access denied")
    with open(full_path, 'r') as f:
        config_data = f.read()
    # Process config_data...

The patched version uses os.path.abspath to resolve the path and then checks that it starts with the allowed base directory, preventing traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Marvell QConvergeConsole with the vulnerable restoreESwitchConfig endpoint exposed.
• Network access to the service (typically port 443 or a custom port).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /restoreESwitchConfig).
2. Send a POST request with a crafted file_path parameter:

   POST /restoreESwitchConfig HTTP/1.1
   Host: target:port
   Content-Type: application/x-www-form-urlencoded
   
   file_path=..\..\..\..\windows\system32\config\sam
   

3. The server responds with the contents of the requested file.

Example using curl:

curl -X POST "http://target:port/restoreESwitchConfig" \
  -d "file_path=..\..\..\..\windows\system32\config\sam" \
  -o sam_hive.bin

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual file read operations by the QConvergeConsole process (e.g., reading sam, system, config files).
• Look for HTTP requests with directory traversal patterns in the file_path parameter.
• Alert on any access to files outside the expected configuration directory.

Hunting Queries:

• Windows Event Log (Sysmon Event ID 11 – FileCreate): Look for file reads by QConvergeConsole.exe targeting sensitive paths.
• Web Server Logs: Search for file_path containing .. or absolute paths like C:\.

Mitigation:

• Immediately restrict network access to the QConvergeConsole service (firewall rules).
• If possible, disable the restoreESwitchConfig endpoint until a patch is available.
• Apply virtual patching via WAF rules to block directory traversal patterns.

Indicators of Compromise (IOCs)

• Network:

  • HTTP POST requests to /restoreESwitchConfig with file_path containing .. or absolute Windows paths.
  • Outbound data transfers from the QConvergeConsole host to external IPs (if exfiltration occurs).

• File System:

  • Unexpected reads of C:\Windows\System32\config\SAM, SYSTEM, SECURITY, or other sensitive files by QConvergeConsole.exe.
  • Temporary files created in the QConvergeConsole data directory containing sensitive data.

• Process:

  • QConvergeConsole.exe spawning child processes (e.g., cmd.exe) to read files (less likely but possible).

Detection Engineering

YARA Rule

rule CVE_2025_6800_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in Marvell QConvergeConsole restoreESwitchConfig"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6800"
    strings:
        $traversal1 = "..\\" ascii wide nocase
        $traversal2 = "../" ascii wide nocase
        $traversal3 = "file_path=" ascii wide nocase
        $sensitive1 = "sam" ascii wide nocase
        $sensitive2 = "system32" ascii wide nocase
    condition:
        all of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-6800 Directory Traversal in Marvell QConvergeConsole
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with directory traversal patterns targeting restoreESwitchConfig
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/restoreESwitchConfig'
        cs-uri-query|contains: 'file_path='
    filter:
        cs-uri-query|contains: 'file_path=..'
    condition: selection and filter
falsepositives:
    - Legitimate use of backup files in subdirectories (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6800 Directory Traversal in Marvell QConvergeConsole"; flow:to_server,established; content:"POST"; http_method; content:"/restoreESwitchConfig"; http_uri; content:"file_path="; http_client_body; pcre:"/file_path=[^&]*\.\./i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Restrict access to the QConvergeConsole service to trusted management networks only. Use firewall rules to block external access.
2. Disable Endpoint: If possible, disable the restoreESwitchConfig method or remove the associated functionality until a patch is available.
3. Virtual Patching: Deploy WAF rules to block requests containing .. or absolute paths in the file_path parameter.

Long-Term Fix:

• Marvell must release a security patch that implements proper input validation and path sanitization (as shown in the patched code example).
• Apply the official patch as soon as it becomes available.

Workaround:

• If the service cannot be patched or disabled, consider running it with reduced privileges (e.g., a dedicated service account with minimal file read permissions). However, this may break functionality.

Valters IT