Webinar | Modernizing Asset Inventory: A Smarter Approach to Securing Industrial Environments
Register
CVE-2025-26346
A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to execute arbitrary SQL commands via crafted HTTP requests.
An authenticated remote attacker may execute arbitrary SQL commands, potentially leading to data exfiltration, modification, or database destruction.
February 11, 2025
This issue affects: Q-Free MaxTime less than or equal to version 2.11.0.
CVE-2025-26346
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
5.5
An official solution has not been communicated by the vendor. By chaining it with NN-2023-0149/CVE-2025-26345, the vulnerability can be exploited by unauthenticated remote attackers. As a temporary solution, until a patch is released, it is highly recommended to restrict and monitor the network access to the management web application exposed by devices running Q-Free MaxTime less than or equal to version 2.11.0.
Andrea Palanca of Nozomi Networks
Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.
Learn more
