CVE-2025-26364

Executive Summary

CVE-2025-26364 is a critical vulnerability in Q-Free MaxTime, a traffic management system, affecting versions up to and including 2.11.0. The flaw resides in the maxprofile/setup/routes.lua file and is classified as CWE-306: Missing Authentication for Critical Function. An unauthenticated, remote attacker can exploit this by sending crafted HTTP requests to disable an authentication profile server, leading to a denial-of-service (DoS) condition. The CVSS v3.1 base score is 7.5 (High), with the attack vector being network-based, low complexity, and requiring no privileges or user interaction. The impact is limited to availability (high), with no confidentiality or integrity impact. No public proof-of-concept (PoC) code or exploit templates are currently available, and the patch status remains unknown/unpatched. This vulnerability poses a significant risk to operational technology (OT) environments where Q-Free MaxTime is deployed for traffic control.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of availability for the authentication profile server.

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, and the impact on availability is severe. In OT environments, this could disrupt traffic management systems, leading to safety hazards.

Deep Dive & Mechanics

The vulnerability is located in the maxprofile/setup/routes.lua file of Q-Free MaxTime. This file likely defines HTTP routes for managing authentication profiles. The specific function that is missing authentication is not publicly detailed, but the CWE-306 classification indicates that a critical function (e.g., disabling an authentication profile server) can be invoked without any authentication check.

Attack Flow:

1. The attacker identifies a Q-Free MaxTime instance (e.g., via Shodan dork http.title:"Q-Free MaxTime").
2. The attacker sends a crafted HTTP request to the vulnerable endpoint, likely a POST or GET request to a specific URI under /maxprofile/setup/.
3. The server processes the request without verifying the user's identity, executing the critical function (e.g., disabling the authentication profile server).
4. The authentication profile server is disabled, causing a denial-of-service condition for authentication services.

Root Cause: The lack of authentication middleware or session validation on the critical route. The developer assumed that only authenticated users would access these endpoints, but no enforcement was implemented.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in maxprofile/setup/routes.lua. A patched version would include authentication checks.

Vulnerable Code (Conceptual):

-- routes.lua (vulnerable)
local function disableAuthProfile(profileId)
    -- Disable the authentication profile
    -- No authentication check
end

-- Route definition
app:post('/maxprofile/setup/disable', function(req, res)
    local profileId = req.params.profileId
    disableAuthProfile(profileId)
    res:send('Profile disabled')
end)

Patched Code (Conceptual):

-- routes.lua (patched)
local function isAuthenticated(req)
    -- Check session token or API key
    return req.session and req.session.user
end

local function disableAuthProfile(profileId)
    -- Disable the authentication profile
end

-- Route definition with authentication middleware
app:post('/maxprofile/setup/disable', function(req, res)
    if not isAuthenticated(req) then
        res:status(401):send('Unauthorized')
        return
    end
    local profileId = req.params.profileId
    disableAuthProfile(profileId)
    res:send('Profile disabled')
end)

Exploitation & Lab Setup

Red Team

Objective: Disable the authentication profile server on a target Q-Free MaxTime instance.

Prerequisites:

• Target IP/domain running Q-Free MaxTime <= 2.11.0.
• Network access to the target (port 80/443 typically).

Exploitation Steps:

1. Reconnaissance: Use Shodan or manual scanning to identify vulnerable instances.

   shodan search http.title:"Q-Free MaxTime"
   

2. Craft Exploit Request: Send a crafted HTTP request to disable the authentication profile server. The exact endpoint is not public, but based on the description, it likely involves a POST to /maxprofile/setup/disable or similar.

   curl -X POST http://target/maxprofile/setup/disable \
     -H "Content-Type: application/json" \
     -d '{"profileId": "1"}'
   

3. Verify Impact: Attempt to authenticate to the system; authentication should fail due to the disabled profile server.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection & Response:

1. Monitor HTTP Logs: Look for unusual POST requests to /maxprofile/setup/ endpoints from unauthenticated sources.
2. Network Segmentation: Ensure Q-Free MaxTime is not exposed to the internet. Use firewalls to restrict access to trusted IPs only.
3. Honeypot: Deploy a decoy MaxTime instance to detect scanning and exploitation attempts.
4. Incident Response: If exploitation is detected, immediately isolate the affected system and restore from a known good backup.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /maxprofile/setup/disable or similar endpoints.
  • Source IPs not in the trusted list.
• System IOCs:
  • Log entries showing Profile disabled or similar success messages without prior authentication.
  • Sudden inability to authenticate to the MaxTime system.
• File IOCs:
  • Unauthorized modifications to maxprofile/setup/routes.lua (if attacker gains write access).

Detection Engineering

YARA Rule

rule CVE_2025_26364_QFree_MaxTime_Exploit {
    meta:
        description = "Detects HTTP requests targeting the vulnerable endpoint in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-26364"
    strings:
        $s1 = "/maxprofile/setup/disable" ascii wide nocase
        $s2 = "profileId" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-26364 Q-Free MaxTime Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to the vulnerable endpoint in Q-Free MaxTime
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxprofile/setup/disable'
    condition: selection
falsepositives:
    - Legitimate administrative actions (if any)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-26364 Q-Free MaxTime Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/maxprofile/setup/disable";
    http_uri;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, disconnect Q-Free MaxTime from untrusted networks (e.g., the internet). Place it behind a firewall with strict access controls.
2. Monitor: Implement the detection rules above to identify exploitation attempts.
3. Workaround: If the source code is accessible, add authentication checks to the vulnerable route in maxprofile/setup/routes.lua (see patched code example).

Long-Term Actions:

1. Patch: Await an official patch from Q-Free. Contact their support for updates.
2. Upgrade: When a patched version is released, upgrade immediately.
3. Network Segmentation: Ensure OT systems like MaxTime are on isolated networks with no direct internet access.
4. Vulnerability Management: Regularly scan for CVEs affecting OT systems and prioritize patching.

Valters IT