CVE-2025-6798: Marvell QConvergeConsole Path Traversal

CVE-2025-6798 Overview

CVE-2025-6798 is a critical directory traversal vulnerability affecting Marvell QConvergeConsole that enables remote attackers to delete arbitrary files on affected systems. The flaw exists within the implementation of the deleteAppFile method, where insufficient validation of user-supplied path input allows attackers to traverse directories and delete files outside of intended directories. Crucially, no authentication is required to exploit this vulnerability, significantly increasing the attack surface.

The vulnerability allows attackers to delete files in the context of SYSTEM, potentially leading to denial of service, data loss, or system instability. This vulnerability was tracked internally as ZDI-CAN-24918 before public disclosure.

Critical Impact

Unauthenticated remote attackers can delete arbitrary files with SYSTEM privileges, potentially causing complete system compromise, denial of service, or data destruction.

Affected Products

• Marvell QConvergeConsole (all versions)

Discovery Timeline

• 2025-07-07 - CVE-2025-6798 published to NVD
• 2025-07-14 - Last updated in NVD database

Technical Details for CVE-2025-6798

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) stems from improper input validation in the deleteAppFile method within Marvell QConvergeConsole. The application fails to properly sanitize user-supplied file paths before passing them to file system operations. An attacker can craft malicious requests containing path traversal sequences (such as ../) to escape the intended directory and target files anywhere on the system.

Since the QConvergeConsole service runs with SYSTEM privileges, any files deleted through this vulnerability are removed with the highest level of system access. This creates a particularly dangerous scenario where critical system files, configuration files, or security components could be targeted for deletion.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it especially severe for environments where QConvergeConsole is exposed to untrusted networks.

Root Cause

The root cause of CVE-2025-6798 is the lack of proper validation and sanitization of user-supplied path input in the deleteAppFile method. The application does not verify that the requested file path remains within the expected application directory, nor does it strip or reject path traversal sequences. This oversight allows attackers to construct paths that traverse outside the intended directory structure and access arbitrary locations on the file system.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send specially crafted requests to the QConvergeConsole service containing directory traversal sequences in the file path parameter of the deleteAppFile method. By manipulating the path with sequences like ../../../, the attacker can navigate up the directory tree and specify any file on the system for deletion.

For example, an attacker could target critical Windows system files, application binaries, security software components, or configuration files. The deletion occurs with SYSTEM-level privileges, ensuring the attacker has unrestricted access to remove any file on the system regardless of normal file permissions.

Technical details and proof-of-concept information can be found in the Zero Day Initiative Advisory ZDI-25-457.

Detection Methods for CVE-2025-6798

Indicators of Compromise

• Unexpected file deletions on systems running QConvergeConsole, particularly system or configuration files
• HTTP/HTTPS requests to QConvergeConsole containing path traversal patterns (e.g., ../, ..%2f, %2e%2e/)
• Calls to the deleteAppFile method with path parameters containing directory traversal sequences
• Service disruptions or application failures caused by missing critical files

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal sequences targeting QConvergeConsole endpoints
• Deploy intrusion detection/prevention systems (IDS/IPS) with signatures for directory traversal attacks against the deleteAppFile method
• Enable detailed access logging on QConvergeConsole to capture all file operation requests for forensic analysis
• Monitor file system integrity using tools like OSSEC or Tripwire to detect unauthorized file deletions

Monitoring Recommendations

• Continuously monitor QConvergeConsole service logs for suspicious file deletion requests or access pattern anomalies
• Implement file integrity monitoring on critical system directories to alert on unexpected file removals
• Set up network traffic analysis to identify exploitation attempts targeting the QConvergeConsole management interface
• Configure SIEM alerts for patterns consistent with directory traversal exploitation attempts

How to Mitigate CVE-2025-6798

Immediate Actions Required

• Restrict network access to Marvell QConvergeConsole to trusted management networks only using firewall rules
• Implement network segmentation to isolate systems running QConvergeConsole from untrusted network segments
• Deploy a web application firewall (WAF) or reverse proxy configured to filter requests containing path traversal patterns
• Monitor systems for signs of compromise and review logs for any exploitation attempts

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-25-457 for the latest information on available patches and vendor guidance. Contact Marvell support directly for security updates addressing this vulnerability.

Workarounds

• Implement strict network access controls to limit connectivity to QConvergeConsole from trusted IP addresses only
• Deploy application-level firewalls to filter and block requests containing directory traversal patterns before they reach the application
• Consider disabling or removing QConvergeConsole from systems where it is not actively required until a patch is available
• Enable enhanced logging and monitoring to detect and respond to exploitation attempts in real-time

# Example: Restrict network access to QConvergeConsole using Windows Firewall
# Block all inbound connections except from trusted management subnet
netsh advfirewall firewall add rule name="Block QConvergeConsole" dir=in action=block protocol=tcp localport=8080
netsh advfirewall firewall add rule name="Allow QConvergeConsole Trusted" dir=in action=allow protocol=tcp localport=8080 remoteip=10.0.0.0/24