Mitsubishi Electric to Acquire Nozomi Networks
Read the News
CVE-2025-26378
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests.
An authenticated low-privileged remote attacker may reset administrator passwords, gaining full control over the system.
February 11, 2025
This issue affects: Q-Free MaxTime less than or equal to version 2.11.0.
CVE-2025-26378
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8
An official solution has not been communicated by the vendor. The vulnerability can be exploited by authenticated remote attackers. As a temporary solution, until a patch is released, it is highly recommended to: 1) periodically review the passwords of users - especially sensitive accounts, e.g., administrators - on the management web application exposed by devices running Q-Free MaxTime less than or equal to version 2.11.0 and confirm that are set as expected; 2) review all accounts on the same management web application and delete unnecessary ones.
Diego Giubertoni of Nozomi Networks
Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.
Learn more
