CVE-2025-6805: Marvell QConvergeConsole Path Traversal

CVE-2025-6805 Overview

CVE-2025-6805 is a critical directory traversal vulnerability affecting Marvell QConvergeConsole that enables remote attackers to delete arbitrary files on affected systems. The vulnerability exists within the deleteEventLogFile method implementation, where insufficient validation of user-supplied paths allows malicious actors to manipulate file operations. This flaw can be exploited without authentication, allowing attackers to delete files with SYSTEM-level privileges, potentially leading to denial of service conditions or complete system compromise.

Critical Impact

Unauthenticated remote attackers can delete arbitrary files with SYSTEM privileges, potentially disrupting critical system operations and enabling further attacks through the removal of security controls.

Affected Products

• Marvell QConvergeConsole
• Marvell QConvergeConsole version 5.5.0.85

Discovery Timeline

• 2025-07-07 - CVE-2025-6805 published to NVD
• 2025-07-14 - Last updated in NVD database

Technical Details for CVE-2025-6805

Vulnerability Analysis

This directory traversal vulnerability (CWE-22) resides in the deleteEventLogFile method of Marvell QConvergeConsole. The core issue stems from improper path validation when processing user-supplied input destined for file deletion operations. The application fails to sanitize path traversal sequences (such as ../ or ..\), allowing attackers to escape the intended directory and target files anywhere on the file system.

Since the QConvergeConsole service operates with elevated SYSTEM privileges, successful exploitation grants attackers the ability to delete any file accessible by the SYSTEM account. This includes critical operating system files, configuration data, security logs, and application binaries. The vulnerability was tracked by the Zero Day Initiative as ZDI-CAN-24925.

Root Cause

The root cause is the absence of proper input validation and sanitization within the deleteEventLogFile method. The function accepts a file path parameter from user requests and directly uses it in file deletion operations without:

1. Validating that the path stays within the expected event log directory
2. Canonicalizing the path to resolve traversal sequences
3. Implementing allowlist-based filename validation
4. Checking against directory traversal patterns

Attack Vector

The vulnerability is exploitable remotely over the network without requiring any authentication credentials. An attacker can craft malicious HTTP requests to the QConvergeConsole web interface, supplying path traversal sequences in the file parameter of the deleteEventLogFile endpoint.

The attack flow typically involves:

1. Identifying a target system running vulnerable QConvergeConsole
2. Crafting a request with directory traversal sequences pointing to a target file
3. Submitting the malicious request to the deleteEventLogFile endpoint
4. The server processes the request and deletes the specified file with SYSTEM privileges

The vulnerability mechanism exploits improper path validation in the deleteEventLogFile method. Attackers supply path traversal sequences such as ..\..\..\..\ to escape the intended event log directory and target arbitrary files on the system. For complete technical details, refer to the Zero Day Initiative Advisory ZDI-25-461.

Detection Methods for CVE-2025-6805

Indicators of Compromise

• HTTP requests to the QConvergeConsole web interface containing path traversal sequences (../, ..\, %2e%2e%2f, %2e%2e/)
• Unusual file deletion events in Windows Security logs, particularly files outside the application's event log directory
• System instability or service failures following network connections to the QConvergeConsole management port
• Missing critical system files or configuration files with no legitimate explanation

Detection Strategies

• Monitor web application logs for requests containing directory traversal patterns targeting the deleteEventLogFile endpoint
• Deploy network intrusion detection signatures to identify path traversal attempts in HTTP traffic to QConvergeConsole
• Implement file integrity monitoring on critical system directories to alert on unauthorized deletions
• Configure SIEM rules to correlate web requests to QConvergeConsole with subsequent file deletion events

Monitoring Recommendations

• Enable verbose logging on the QConvergeConsole application to capture all file operation requests
• Implement Windows file system auditing for deletion events, particularly in system directories
• Monitor for unexpected service restarts or system instability that could indicate exploitation attempts
• Track network connections to QConvergeConsole management ports from untrusted sources

How to Mitigate CVE-2025-6805

Immediate Actions Required

• Restrict network access to QConvergeConsole management interfaces using firewall rules or network segmentation
• Limit access to the QConvergeConsole web interface to trusted administrative workstations only
• Implement web application firewall rules to block requests containing path traversal sequences
• Monitor systems for signs of exploitation while awaiting an official patch

Patch Information

At the time of publication, consult Marvell's official security resources for patch availability. Organizations should monitor the Zero Day Initiative Advisory ZDI-25-461 for updates and remediation guidance. Contact Marvell support for the latest security updates addressing this vulnerability.

Workarounds

• Disable or restrict access to the QConvergeConsole web management interface if not operationally required
• Place QConvergeConsole systems behind a network firewall that blocks external access to the management port
• Implement network segmentation to isolate storage management infrastructure from general network traffic
• Use VPN or jump hosts to control administrative access to QConvergeConsole systems

# Example: Windows Firewall rule to restrict QConvergeConsole access
netsh advfirewall firewall add rule name="Block QConvergeConsole External Access" dir=in action=block protocol=tcp localport=8080 remoteip=any
netsh advfirewall firewall add rule name="Allow QConvergeConsole Admin Subnet" dir=in action=allow protocol=tcp localport=8080 remoteip=10.0.0.0/24