CVE-2025-1102 | Nozomi Networks Labs

Summary

A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.

Impact

An unauthenticated remote attacker may bypass security policies to access or manipulate sensitive data via crafted URLs or HTTP requests.

Issue Date

February 11, 2025

Affects

This issue affects: Q-Free MaxTime less than or equal to version 2.11.0.

CVE Name

CVE-2025-1102

CVSS Details

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS Score

5.5

Solution

An official solution has not been communicated by the vendor. The vulnerability can be exploited by unauthenticated remote attackers against authenticated victims. As a temporary solution, until a patch is released, it is highly recommended to apply care while opening untrusted links or visiting external websites with a browsing session to the management web application exposed by devices running Q-Free MaxTime less than or equal to version 2.11.0 opened.

Mitigations

Acknowledgements

Andrea Palanca of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more