CVE-2025-6807

Executive Summary

CVE-2025-6807 is a directory traversal vulnerability in Marvell QConvergeConsole, specifically within the getDriverTmpPath method. This flaw allows an unauthenticated remote attacker to read arbitrary files on the system, leading to information disclosure at the SYSTEM privilege level. The vulnerability has a CVSS score of 5.3 (Medium) and is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not confirmed a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the impact is significant due to SYSTEM-level access.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Marvell enterprise management console, which may be distributed as part of hardware bundles or standalone software. Organizations using Marvell QConvergeConsole should treat this as a critical supply chain risk due to the lack of patch availability.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the confidentiality impact is low, the ability to read arbitrary files as SYSTEM can lead to credential theft, configuration exposure, and lateral movement. The lack of authentication and low complexity make this a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability resides in the getDriverTmpPath method of Marvell QConvergeConsole. This method is used to retrieve a temporary path for driver files. The flaw occurs because the method does not properly validate user-supplied path input before using it in file operations. An attacker can supply a path traversal sequence (e.g., ../../) to escape the intended directory and read arbitrary files on the filesystem.

Root Cause: The application fails to sanitize or canonicalize the user-supplied path, allowing directory traversal. This is a classic CWE-22 vulnerability.

Impact: An unauthenticated remote attacker can read sensitive files such as configuration files, credentials, system files, or other data accessible to the SYSTEM account. This can lead to further compromise of the system and network.

Affected Component: Marvell QConvergeConsole (likely versions prior to any hypothetical patch). No specific version range is available.

Vulnerable vs. Patched Code

Since no patch or source code is publicly available, the following is a hypothetical representation of the vulnerable and patched code.

Vulnerable Code (C# example):

public string GetDriverTmpPath(string userPath)
{
    string basePath = @"C:\ProgramData\Marvell\QConvergeConsole\Temp\";
    string fullPath = basePath + userPath; // No validation
    return fullPath;
}

Patched Code (C# example):

public string GetDriverTmpPath(string userPath)
{
    string basePath = @"C:\ProgramData\Marvell\QConvergeConsole\Temp\";
    string fullPath = Path.GetFullPath(Path.Combine(basePath, userPath));
    if (!fullPath.StartsWith(basePath, StringComparison.OrdinalIgnoreCase))
    {
        throw new SecurityException("Invalid path.");
    }
    return fullPath;
}

The patched version uses Path.GetFullPath to canonicalize the path and then checks that the result starts with the intended base directory, preventing traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Marvell QConvergeConsole with the vulnerable getDriverTmpPath method exposed.
• Network access to the console (typically on port 443 or a custom port).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /api/getDriverTmpPath).
2. Send a crafted request with a path traversal payload:

   POST /api/getDriverTmpPath HTTP/1.1
   Host: target:port
   Content-Type: application/json
   
   {"path": "../../../../Windows/System32/config/SAM"}
   

3. The server responds with the contents of the requested file (if accessible).

Example using curl:

curl -X POST https://target:port/api/getDriverTmpPath \
  -H "Content-Type: application/json" \
  -d '{"path":"../../../../Windows/System32/config/SAM"}'

Expected Output: The contents of the SAM file (or other sensitive files) are returned in the response.

Blue Team

Detection:

• Monitor for unusual path traversal patterns in HTTP requests (e.g., ../, ..\\).
• Alert on requests to the getDriverTmpPath endpoint with suspicious path parameters.
• Use file integrity monitoring (FIM) to detect unauthorized reads of sensitive files.

Hunting:

• Search logs for requests containing getDriverTmpPath with path traversal sequences.
• Correlate with file access logs to identify reads of SYSTEM-level files.

Mitigation:

• If possible, restrict network access to the QConvergeConsole to trusted IPs only.
• Apply virtual patching via WAF rules to block path traversal patterns.
• Monitor for any exploitation attempts and isolate affected systems.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/getDriverTmpPath with path traversal sequences (e.g., ../, ..\\).
  • Outbound connections from the console to unknown IPs (data exfiltration).

• File IOCs:

  • Unauthorized reads of files like SAM, SYSTEM, SECURITY, or configuration files in C:\ProgramData\Marvell\.

• Log IOCs:

  • Application logs showing getDriverTmpPath calls with suspicious paths.
  • Windows Event Logs (Event ID 4663) indicating access to sensitive files by the QConvergeConsole process.

Detection Engineering

YARA Rule

rule CVE_2025_6807_Marvell_QConvergeConsole_Traversal {
    meta:
        description = "Detects path traversal attempts in Marvell QConvergeConsole getDriverTmpPath"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-6807"
    strings:
        $traversal1 = "..\\" ascii wide nocase
        $traversal2 = "../" ascii wide nocase
        $endpoint = "getDriverTmpPath" ascii wide nocase
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2025-6807 - Marvell QConvergeConsole Directory Traversal
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects path traversal attempts against Marvell QConvergeConsole getDriverTmpPath endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "getDriverTmpPath"
        cs-uri-query|contains: 
            - "..\\"
            - "../"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6807 - Marvell QConvergeConsole Directory Traversal"; flow:to_server,established; content:"getDriverTmpPath"; http_uri; content:".."; http_uri; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Marvell QConvergeConsole from untrusted networks (e.g., place behind a firewall with strict ACLs).
2. Apply virtual patching using a WAF or IPS to block path traversal patterns in requests to the console.
3. Monitor logs for exploitation attempts and respond accordingly.

Long-Term Fix:

• Contact Marvell support for an official patch or workaround.
• If no patch is available, consider disabling or removing the vulnerable component if not essential.
• Implement input validation and canonicalization in any custom code that interfaces with the console.

Compensating Controls:

• Use network segmentation to limit access to the console.
• Enable detailed logging and alerting for file access anomalies.
• Regularly review and rotate credentials that may be exposed via this vulnerability.

Valters IT