CVE-2025-6795: Marvell Qconvergeconsole Path Traversal

CVE-2025-6795 Overview

CVE-2025-6795 is a directory traversal vulnerability in Marvell QConvergeConsole that allows unauthenticated remote attackers to disclose sensitive information from affected installations. The flaw resides in the getFileUploadSize method, which fails to properly validate user-supplied paths before using them in file operations. Successful exploitation grants attackers the ability to read arbitrary files in the context of the SYSTEM account on Windows hosts. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-24914 and assigned CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact

Unauthenticated remote attackers can read arbitrary files with SYSTEM-level privileges over the network, exposing credentials, configuration data, and other sensitive artifacts.

Affected Products

• Marvell QConvergeConsole (all versions matching the CPE cpe:2.3:a:marvell:qconvergeconsole)
• Deployments running the QConvergeConsole management web service
• Windows hosts where QConvergeConsole runs with SYSTEM privileges

Discovery Timeline

• 2025-07-07 - CVE-2025-6795 published to NVD
• 2025-07-14 - Last updated in NVD database
• Tracked by the Zero Day Initiative as ZDI-CAN-24914 / ZDI-25-455

Technical Details for CVE-2025-6795

Vulnerability Analysis

QConvergeConsole exposes a web-based management interface for Marvell QLogic Fibre Channel and converged network adapters. The getFileUploadSize method accepts a path parameter intended to reference an upload artifact, then performs a file size lookup on that path. Because the method does not canonicalize or restrict the supplied path, attackers can submit traversal sequences such as ..\..\..\ to step outside the intended directory.

The service runs as SYSTEM, so the file operations execute with full local privileges. Attackers can target Windows system files, application configuration, private keys, and stored credentials. The vulnerability requires no authentication and is reachable over the network where the management interface is exposed.

The Exploit Prediction Scoring System places this issue in the 84th percentile, reflecting moderate near-term exploitation likelihood. No public proof-of-concept has been published at the time of writing, but the ZDI advisory provides sufficient detail for a competent attacker to reproduce the flaw.

Root Cause

The root cause is improper input validation [CWE-22]. The getFileUploadSize handler concatenates a user-supplied path component into a filesystem call without normalizing the result or enforcing a base directory allow-list. Standard traversal payloads bypass the implicit assumption that the parameter remains within the upload directory.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the QConvergeConsole management endpoint exposing getFileUploadSize. The request includes a path parameter containing directory traversal sequences pointing at a target file. The service returns the file size or related metadata, and through repeated requests or related file-read primitives in the same component family, the attacker enumerates and discloses file contents. Because the service runs as SYSTEM, no file outside the OS access controls is off-limits.

No verified public exploit code is available. Refer to the Zero Day Initiative advisory ZDI-25-455 for technical details.

Detection Methods for CVE-2025-6795

Indicators of Compromise

• HTTP requests to QConvergeConsole endpoints containing getFileUploadSize with path parameters that include ..\, ../, or URL-encoded equivalents such as %2e%2e%2f.
• Access log entries showing unauthenticated requests to the QConvergeConsole management port from unexpected source addresses.
• Unusual outbound network activity from the QConvergeConsole host immediately after suspicious request patterns.

Detection Strategies

• Inspect web server and application logs on QConvergeConsole hosts for path parameters containing traversal sequences targeting getFileUploadSize.
• Deploy network-based signatures on management subnets to flag HTTP requests carrying encoded or literal .. sequences directed at the QConvergeConsole listener.
• Correlate file-access telemetry from the SYSTEM-owned QConvergeConsole process with requests against the management interface to identify out-of-policy file reads.

Monitoring Recommendations

• Forward QConvergeConsole HTTP access logs and Windows process telemetry to a centralized analytics platform for retention and search.
• Alert on any read access by the QConvergeConsole service process to sensitive paths such as C:\Windows\System32\config\, user profile directories, and credential stores.
• Monitor for repeated probing patterns against the management port, including high-frequency requests with varying path parameters.

How to Mitigate CVE-2025-6795

Immediate Actions Required

• Restrict network access to the QConvergeConsole management interface using host firewalls or network segmentation, allowing only trusted administrative subnets.
• Audit running QConvergeConsole instances and identify versions in use, prioritizing internet-exposed or DMZ deployments for immediate isolation.
• Review recent access logs for traversal patterns indicating prior exploitation attempts and investigate any matches.

Patch Information

At the time of publication, no vendor patch URL is listed in the NVD record. Consult Marvell support channels and the Zero Day Initiative advisory ZDI-25-455 for the current remediation status. Apply vendor-supplied updates as soon as they become available.

Workarounds

• Disable the QConvergeConsole web service on hosts where it is not actively required for adapter management.
• Bind the management listener to localhost only and require administrators to access it through an authenticated jump host or VPN.
• Place a reverse proxy or web application firewall in front of the service to block requests containing directory traversal sequences.

# Example Windows firewall rule restricting QConvergeConsole to a management subnet
netsh advfirewall firewall add rule name="QConvergeConsole-Restrict" ^
  dir=in action=allow protocol=TCP localport=8080 ^
  remoteip=10.0.10.0/24 profile=any

netsh advfirewall firewall add rule name="QConvergeConsole-Block-All" ^
  dir=in action=block protocol=TCP localport=8080