CVE-2025-26361
📋 TL;DR
CVE-2025-26361 allows unauthenticated remote attackers to factory reset Q-Free MaxTime devices via crafted HTTP requests due to missing authentication on critical functions. This affects all Q-Free MaxTime versions up to and including 2.11.0. Organizations using these traffic management systems are vulnerable to service disruption.
💻 Affected Systems
- Q-Free MaxTime
📦 What is this software?
Maxtime by Q Free
⚠️ Risk & Real-World Impact
Worst Case
Complete system disruption with loss of all configuration, traffic data, and operational settings requiring manual reconfiguration and causing extended traffic management outages.
Likely Case
Service disruption requiring device reconfiguration and temporary loss of traffic management capabilities.
If Mitigated
Minimal impact if devices are behind firewalls with strict network controls and authentication requirements.
🎯 Exploit Status
Simple HTTP request exploitation requiring no authentication or special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 2.11.0
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26361
Restart Required: Yes
Instructions:
1. Contact Q-Free for patched version >2.11.0. 2. Backup device configuration. 3. Apply update following vendor instructions. 4. Restart device. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxIsolate MaxTime devices behind firewalls with strict inbound rules.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Web Application Firewall
allDeploy WAF to block malicious HTTP requests to setup endpoints.
🧯 If You Can't Patch
- Implement strict network access controls allowing only authorized management IPs.
- Monitor for HTTP requests to /maxprofile/setup/ endpoints and alert on suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check device version via web interface or CLI. If version ≤2.11.0, device is vulnerable.Check Version:
Check web interface or consult device documentation for version command.Verify Fix Applied:
Verify version >2.11.0 and test that unauthenticated HTTP POST requests to setup endpoints return authentication errors.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /maxprofile/setup/* endpoints from unauthenticated sources
- Factory reset events in system logs
Network Indicators:
- HTTP traffic to device on ports 80/443 with POST requests containing reset parameters
SIEM Query:
source="maxprofile" AND (uri_path="/maxprofile/setup/*" OR event="factory_reset")