Michael Heinzl
Source-scoped identity with 23 associated PoCs and 27 linked vulnerabilities.
Exploit catalog results
Showing 23 PoCs on this page
MetasploitMarvell QConvergeConsole Path Traversal (CVE-2025-6793)
Metasploit auxiliary PoCby rgodAdded to Metasploit 2026-04-16ExploitCVE-2025-67931 file
Analysis
Technical assessment
Metasploit auxiliary module that exploits CVE-2025-6793, a path traversal vulnerability in Marvell QConvergeConsole, to retrieve and delete arbitrary files from the target system without authentication.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that exploits CVE-2025-6793, a path traversal vulnerability in Marvell QConvergeConsole. It reads and deletes a specified file from the target. No backdoor, deceptive payload, or concealed operator-directed harm is present. The module includes a DefangedMode safety check and uses only documented Metasploit APIs for HTTP requests, file storage, and reporting.
ClassificationExploit
Model confidence95%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The module actively sends crafted HTTP requests to exploit a path traversal vulnerability, retrieves file contents, and stores them as loot. This constitutes exploitation, not just scanning or detection.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:102-146Requirements
- Target must be running Marvell QConvergeConsole <= v5.5.0.85 with the vulnerable QLogicDownloadServlet endpoint accessible.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:17-18
Observed behavior
- Sends an HTTP GET request to the QLogicDownloadServlet endpoint with user-controlled folder and file parameters to read an arbitrary file from the target system.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:114-128 - Stores the retrieved file content as loot in the Metasploit database.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:136 - The file retrieval operation also deletes the file from the remote server as a side effect.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:18 - Includes a check method that fingerprints the target version by extracting a GWT strong name and version string from JavaScript files.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:56-100
Behaviors behind the backdoor verdict
Observables
- Safety Mechanism
- Payload withheldDemonstrates the module author's intent to warn operators about the destructive file deletion side effect, consistent with legitimate security tooling.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:51modules/auxiliary/gather/qconvergeconsole_traversal.rb:103-113 - Destructive Behavior Disclosure
- Payload withheldThe file deletion is a known side effect of the vulnerability, not a hidden backdoor. The module transparently discloses this behavior.
modules/auxiliary/gather/qconvergeconsole_traversal.rb:17-18modules/auxiliary/gather/qconvergeconsole_traversal.rb:105-107
What the analysis did not establish
- Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The evidence does not include runtime execution output or confirmation that the exploit works against a live target.
- Only the module source and metadata are reviewed; Metasploit framework mixins (HttpClient, AutoCheck, Report) and libraries are not expanded, but the module's use of them is standard and non-suspicious.
- Binary files are flagged as metadata-only and not analyzed, but no binary files are included in the evidence.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.