CVE-2025-26364
📋 TL;DR
An unauthenticated remote attacker can disable authentication profile servers in Q-Free MaxTime traffic management systems by sending crafted HTTP requests. This affects all Q-Free MaxTime installations running version 2.11.0 or earlier. The vulnerability allows attackers to potentially disrupt authentication services without requiring valid credentials.
💻 Affected Systems
- Q-Free MaxTime
📦 What is this software?
Maxtime by Q Free
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of authentication services leading to unauthorized access to traffic management systems, potential manipulation of traffic signals, and system-wide authentication bypass.
Likely Case
Temporary disruption of authentication services requiring manual intervention to restore, potentially causing authentication failures for legitimate users.
If Mitigated
Limited impact with proper network segmentation and authentication controls in place, though authentication services may still be temporarily affected.
🎯 Exploit Status
Exploitation requires sending crafted HTTP requests to the vulnerable endpoint. No authentication is required, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 2.11.0
Vendor Advisory: https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26364
Restart Required: No
Instructions:
1. Contact Q-Free for the latest patched version. 2. Upgrade MaxTime to version newer than 2.11.0. 3. Verify the patch is applied by checking the maxprofile/setup/routes.lua file.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to MaxTime administration interfaces
Web Application Firewall
allImplement WAF rules to block crafted HTTP requests to vulnerable endpoints
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MaxTime servers from untrusted networks
- Deploy intrusion detection systems to monitor for crafted HTTP requests targeting the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check MaxTime version via administration interface or configuration files. If version is 2.11.0 or earlier, the system is vulnerable.Check Version:
Check MaxTime administration interface or configuration files for version informationVerify Fix Applied:
Verify MaxTime version is greater than 2.11.0 and test that crafted HTTP requests to the vulnerable endpoint no longer disable authentication services.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to maxprofile/setup endpoints from unauthenticated sources
- Authentication service disruption events
- Unexpected authentication profile server shutdowns
Network Indicators:
- HTTP POST/PUT requests to vulnerable endpoints without authentication headers
- Traffic patterns indicating authentication service disruption
SIEM Query:
source="maxtime" AND (uri="/maxprofile/setup" OR event="authentication_disabled") AND src_ip NOT IN authenticated_ips