CVE-2025-26356 | Nozomi Networks Labs

Summary

A CWE-35 "Path Traversal" in maxtime/api/database/database.lua (setActive endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to overwrite sensitive files via crafted HTTP requests.

Impact

An authenticated remote attacker may overwrite sensitive files, leading to data corruption or privilege escalation.

Issue Date

February 11, 2025

Affects

This issue affects: Q-Free MaxTime less than or equal to version 2.11.0.

CVE Name

CVE-2025-26356

CVSS Details

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS Score

7.2

Solution

An official solution has not been communicated by the vendor. By chaining it with NN-2023-0143/CVE-2025-26339, the vulnerability can be exploited by unauthenticated remote attackers. As a temporary solution, until a patch is released, it is highly recommended to restrict and monitor the network access to the management web application exposed by devices running Q-Free MaxTime less than or equal to version 2.11.0.

Mitigations

Acknowledgements

Diego Giubertoni of Nozomi Networks

Nozomi Threat Intelligence

Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.

Learn more