CVE-2025-6804

Executive Summary

CVE-2025-6804 is a critical directory traversal vulnerability in Marvell QConvergeConsole, specifically within the compressFirmwareDumpFiles method. This flaw allows unauthenticated remote attackers to read arbitrary files on the system, leading to information disclosure at the SYSTEM privilege level. The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No public proof-of-concept (PoC) or exploit code is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the lack of authentication requirements.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is remotely exploitable without authentication, allowing attackers to read sensitive files (e.g., configuration files, credentials, or system data) from the underlying SYSTEM context.

Deep Dive & Mechanics

The vulnerability resides in the compressFirmwareDumpFiles method of Marvell QConvergeConsole. This method is designed to compress firmware dump files for diagnostic purposes. However, it fails to properly validate user-supplied paths before using them in file operations. An attacker can supply a path traversal sequence (e.g., ../../windows/system32/config/sam) to read arbitrary files outside the intended directory.

Root Cause: The application does not sanitize or restrict the path input, allowing directory traversal. The method likely uses a function like File.ReadAllBytes() or File.OpenRead() with the attacker-controlled path, leading to information disclosure.

Impact: An attacker can exfiltrate sensitive data such as:

• System configuration files (e.g., SAM, SYSTEM registry hives)
• Application credentials or secrets
• Other sensitive documents

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the compressFirmwareDumpFiles method. A patched version would implement path validation, such as:

Vulnerable Code (Conceptual):

public void compressFirmwareDumpFiles(string userPath) {
    string fullPath = Path.Combine(baseDirectory, userPath);
    byte[] fileData = File.ReadAllBytes(fullPath);
    // Compress and return data
}

Patched Code (Conceptual):

public void compressFirmwareDumpFiles(string userPath) {
    string fullPath = Path.GetFullPath(Path.Combine(baseDirectory, userPath));
    if (!fullPath.StartsWith(baseDirectory, StringComparison.OrdinalIgnoreCase)) {
        throw new SecurityException("Invalid path.");
    }
    byte[] fileData = File.ReadAllBytes(fullPath);
    // Compress and return data
}

The patched version uses Path.GetFullPath() to resolve the path and then checks that it starts with the intended base directory, preventing traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Marvell QConvergeConsole with the vulnerable method exposed (likely via HTTP/SOAP or REST API).
• No authentication required.

Exploitation Steps:

1. Identify the endpoint that calls compressFirmwareDumpFiles. This may be found via API documentation or fuzzing.
2. Craft a request with a path traversal payload, e.g., ../../windows/system32/config/sam.
3. Send the request and capture the response containing the file contents.

Example Request (HTTP POST):

POST /api/compressFirmwareDumpFiles HTTP/1.1
Host: target.example.com
Content-Type: application/json

{
  "path": "../../windows/system32/config/sam"
}

Expected Response: The response will contain the base64-encoded or raw contents of the SAM file.

Blue Team

Detection:

• Monitor for unusual file read operations from the QConvergeConsole process.
• Look for path traversal patterns in API requests (e.g., ../, ..\\, %2e%2e%2f).
• Alert on access to sensitive system files (e.g., SAM, SYSTEM, config files).

Mitigation:

• If possible, restrict network access to the QConvergeConsole interface.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Monitor logs for anomalous file access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing path traversal sequences (e.g., ../, ..\\, %2e%2e%2f) to the QConvergeConsole API.
  • Outbound data transfers from the QConvergeConsole server to external IPs (if exfiltration occurs).

• File IOCs:

  • Unauthorized access to files outside the intended dump directory (e.g., C:\Windows\System32\config\SAM).
  • Temporary files created by the compression process containing sensitive data.

• Process IOCs:

  • QConvergeConsole process reading files outside its normal working directory.

Detection Engineering

YARA Rule

rule CVE_2025_6804_Marvell_QConvergeConsole_Traversal {
    meta:
        description = "Detects path traversal attempts in Marvell QConvergeConsole compressFirmwareDumpFiles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6804"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $traversal4 = "%2e%2e%5c" ascii wide nocase
        $method = "compressFirmwareDumpFiles" ascii wide nocase
    condition:
        $method and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-6804 - Marvell QConvergeConsole Directory Traversal
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in Marvell QConvergeConsole compressFirmwareDumpFiles method
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6804
logsource:
    category: webserver
    product: marvell_qconvergeconsole
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
        cs-uri-stem|contains: 'compressFirmwareDumpFiles'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in non-vulnerable contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6804 - Marvell QConvergeConsole Directory Traversal"; flow:to_server,established; content:"compressFirmwareDumpFiles"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the QConvergeConsole from untrusted networks (e.g., place behind a firewall or VPN).
2. Implement a WAF rule to block path traversal patterns in requests to the QConvergeConsole API.
3. Monitor logs for any signs of exploitation.

Long-Term Fix:

• Await an official patch from Marvell. If no patch is forthcoming, consider disabling the compressFirmwareDumpFiles method or removing the feature entirely.
• Apply input validation and path sanitization as shown in the patched code example.

Workaround:

• If the feature is not critical, block access to the endpoint via network ACLs or application configuration.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert