CVE-2025-6800
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to read arbitrary files on systems running Marvell QConvergeConsole. Attackers can exploit a directory traversal flaw in the restoreESwitchConfig method to access sensitive information with SYSTEM privileges. All installations using affected versions are vulnerable.
💻 Affected Systems
- Marvell QConvergeConsole
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through disclosure of credentials, configuration files, or other sensitive data leading to lateral movement or privilege escalation.
Likely Case
Information disclosure of configuration files, logs, or other sensitive data stored on the server, potentially exposing credentials or network information.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to the vulnerable service.
🎯 Exploit Status
Directory traversal vulnerabilities typically have low exploitation complexity. No authentication required makes weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-459/
Restart Required: Yes
Instructions:
1. Check Marvell security advisories for specific patch version. 2. Download and apply the latest patch from Marvell. 3. Restart the QConvergeConsole service. 4. Verify the patch is applied successfully.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to QConvergeConsole to trusted IP addresses only
Use firewall rules to limit access to specific source IPs
Service Disablement
windowsTemporarily disable the vulnerable service if not critically needed
sc stop "Marvell QConvergeConsole Service"
sc config "Marvell QConvergeConsole Service" start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy web application firewall with directory traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Marvell QConvergeConsole is installed and running. Review version against vendor advisory for affected versions.Check Version:
Check application version through QConvergeConsole interface or installed programs listVerify Fix Applied:
Verify patch installation through version check and test that directory traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- HTTP requests containing ../ or directory traversal sequences to restoreESwitchConfig endpoint
Network Indicators:
- HTTP requests with path traversal payloads to QConvergeConsole service
SIEM Query:
source="*qconverge*" AND (uri="*../*" OR uri="*..\\*" OR method="POST" AND uri="*restoreESwitchConfig*")