CVE-2025-6801: Marvell Qconvergeconsole Path Traversal

CVE-2025-6801 Overview

CVE-2025-6801 is a directory traversal vulnerability in Marvell QConvergeConsole that enables remote, unauthenticated attackers to write arbitrary files to affected systems. The flaw resides in the saveNICParamsToFile method, which fails to properly validate user-supplied paths before performing file operations. Successful exploitation grants attackers the ability to write files in the context of the SYSTEM account on Windows installations. The issue is tracked by the Zero Day Initiative as ZDI-CAN-24921 and classified under CWE-22 Path Traversal.

Critical Impact

Unauthenticated remote attackers can write arbitrary files as SYSTEM, enabling configuration tampering, persistence, and potential code execution on affected QConvergeConsole installations.

Affected Products

• Marvell QConvergeConsole (management application for QLogic adapters)
• Windows installations running the QConvergeConsole service under the SYSTEM account
• All currently distributed versions prior to the vendor's remediation

Discovery Timeline

• 2025-07-07 - CVE-2025-6801 published to the National Vulnerability Database
• 2025-07-14 - Last updated in NVD database
• ZDI-CAN-24921 - Tracked by the Zero Day Initiative as advisory ZDI-25-460

Technical Details for CVE-2025-6801

Vulnerability Analysis

Marvell QConvergeConsole is a web-based management console used to configure and monitor QLogic network and storage adapters. The vulnerability exists in the saveNICParamsToFile method, which accepts a file path parameter from remote callers. Because the method does not validate or canonicalize the supplied path, attackers can supply traversal sequences such as ..\..\ to escape the intended output directory.

The service runs with SYSTEM privileges on Windows hosts. An attacker can write files anywhere on the file system, including startup directories, scheduled task definitions, or service binaries. This directory traversal weakness can be chained with other techniques to achieve code execution or establish persistence.

The Exploit Prediction Scoring System places this issue in the 86th percentile, indicating elevated likelihood of exploitation relative to the broader CVE population.

Root Cause

The root cause is missing input validation on a user-supplied file path before it is passed to a file write routine. The saveNICParamsToFile handler trusts the path argument as provided and does not normalize the path, restrict it to a designated directory, or reject traversal characters. This violates the canonicalization requirements described in CWE-22.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to the QConvergeConsole management interface that invokes saveNICParamsToFile with a path containing traversal segments. The service writes the attacker-controlled content to the targeted location with SYSTEM privileges. Refer to ZDI-25-460 for the underlying technical analysis.

Detection Methods for CVE-2025-6801

Indicators of Compromise

• Unexpected files appearing in privileged directories such as C:\Windows\System32\, C:\ProgramData\, or service install paths after QConvergeConsole activity
• HTTP requests to the QConvergeConsole management endpoint containing ..\, ../, or URL-encoded traversal sequences (%2e%2e%5c)
• New or modified scheduled tasks, services, or autorun entries created by the QConvergeConsole service process
• Anomalous file write events originating from the QConvergeConsole Java or service process outside its installation directory

Detection Strategies

• Inspect web server and application logs for requests invoking saveNICParamsToFile with non-standard path arguments
• Deploy file integrity monitoring on system directories and QConvergeConsole installation paths to flag writes from the service account
• Apply behavioral identification rules that correlate process lineage from QConvergeConsole with file writes to sensitive locations
• Hunt for outbound connections from hosts running QConvergeConsole that follow suspicious file-write events

Monitoring Recommendations

• Forward QConvergeConsole HTTP access logs to a centralized analytics platform for traversal pattern matching
• Monitor Windows Security Event ID 4663 for file creation events under privileged paths by the QConvergeConsole service
• Alert on creation of executables, DLLs, or script files within user profile startup folders by service-tier processes
• Track service restarts and binary replacement events on hosts running QConvergeConsole

How to Mitigate CVE-2025-6801

Immediate Actions Required

• Restrict network access to the QConvergeConsole management interface to trusted administrative segments only
• Block external traffic to QConvergeConsole listening ports at the perimeter firewall
• Audit hosts running QConvergeConsole for unexpected files, services, or scheduled tasks created since deployment
• Apply vendor updates from Marvell as soon as they become available

Patch Information

At the time of publication, no public vendor advisory URL is referenced in the NVD entry for CVE-2025-6801. Administrators should consult the Marvell support portal for the latest QConvergeConsole release and confirm that updates address ZDI-CAN-24921. The Zero Day Initiative advisory is published at ZDI-25-460.

Workarounds

• Place QConvergeConsole hosts on an isolated management VLAN with strict access control lists
• Require VPN or jump-host access for administrators interacting with the management interface
• Stop and disable the QConvergeConsole service on systems where active management is not required
• Enforce host-based firewall rules that limit inbound connections to the management port to specific administrative IP addresses

# Example Windows firewall rule restricting QConvergeConsole access to a management subnet
netsh advfirewall firewall add rule name="Restrict QConvergeConsole" ^
  dir=in action=block protocol=TCP localport=8080
netsh advfirewall firewall add rule name="Allow QConvergeConsole Mgmt" ^
  dir=in action=allow protocol=TCP localport=8080 remoteip=10.0.10.0/24