CVE-2025-26365

Executive Summary

CVE-2025-26365 is a critical security vulnerability in Q-Free MaxTime, a traffic management system, affecting versions up to and including 2.11.0. The flaw is a Missing Authentication for Critical Function (CWE-306) located in the maxprofile/setup/routes.lua file. An unauthenticated remote attacker can exploit this by sending crafted HTTP requests to enable front panel authentication, bypassing security controls. With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to the integrity of the system, potentially allowing unauthorized configuration changes. No public proof-of-concept (PoC) or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary embedded system (Q-Free MaxTime) and is not part of a standard software supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: High (I:H) – Unauthorized modification of system settings.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to modify critical authentication settings, potentially leading to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the maxprofile/setup/routes.lua file, which handles HTTP routing for the MaxTime system’s setup interface. The specific function responsible for enabling or disabling front panel authentication lacks proper authentication checks. An attacker can send a crafted HTTP request to the endpoint, bypassing any login requirements, and toggle the authentication setting.

Technical Details:

• Affected Endpoint: Likely /maxprofile/setup/routes.lua or a related route.
• Attack Vector: HTTP POST or GET request with parameters to enable front panel authentication.
• Root Cause: The code does not verify the user’s session or credentials before executing the critical function.
• Impact: Enabling front panel authentication may lock out legitimate users or allow the attacker to set a new authentication method, leading to unauthorized access.

Example Request (Hypothetical):

POST /maxprofile/setup/routes.lua HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

action=enable_frontend_auth&auth_type=local

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in maxprofile/setup/routes.lua. A patched version would include authentication checks.

Vulnerable Code (Hypothetical):

-- Vulnerable: No authentication check
function handle_setup_request(req)
    if req.action == "enable_frontend_auth" then
        enable_frontend_authentication(req.auth_type)
    end
end

Patched Code (Hypothetical):

-- Patched: Authentication check added
function handle_setup_request(req)
    if not is_authenticated(req) then
        return 401, "Unauthorized"
    end
    if req.action == "enable_frontend_auth" then
        enable_frontend_authentication(req.auth_type)
    end
end

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Enable front panel authentication without credentials.

Lab Setup:

1. Deploy a Q-Free MaxTime system (version <= 2.11.0) in a controlled environment.
2. Use a tool like curl or Burp Suite to send crafted requests.

Exploitation Steps:

1. Identify the target IP (e.g., 192.168.1.100).
2. Send a POST request to the vulnerable endpoint:

   curl -X POST http://192.168.1.100/maxprofile/setup/routes.lua \
     -d "action=enable_frontend_auth&auth_type=local"
   

3. Verify the change by attempting to access the front panel without authentication.

Expected Outcome: The front panel authentication is enabled, potentially locking out legitimate users or allowing the attacker to set a new password.

Blue Team (Defender)

Objective: Detect and block exploitation attempts.

Detection Steps:

1. Monitor HTTP requests to /maxprofile/setup/routes.lua for unusual parameters.
2. Look for requests with action=enable_frontend_auth or similar.
3. Implement network segmentation to limit access to the management interface.
4. Use WAF rules to block unauthenticated requests to critical endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /maxprofile/setup/routes.lua with parameters like action=enable_frontend_auth.
  • Unusual POST requests from external IPs to the management interface.
• System IOCs:
  • Changes to front panel authentication settings without corresponding login events.
  • Log entries showing successful requests to the vulnerable endpoint from unauthenticated sources.
• File IOCs:
  • Modified routes.lua file (if attacker uploads malicious version).

Detection Engineering

YARA Rule

rule CVE_2025_26365_QFree_MaxTime {
    meta:
        description = "Detects exploitation attempts for CVE-2025-26365 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26365"
    strings:
        $s1 = "action=enable_frontend_auth" ascii wide nocase
        $s2 = "auth_type=" ascii wide nocase
        $s3 = "/maxprofile/setup/routes.lua" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-26365 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint in Q-Free MaxTime
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxprofile/setup/routes.lua'
        cs-uri-query|contains: 'action=enable_frontend_auth'
    condition: selection
falsepositives:
    - Legitimate administrative actions (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26365 Q-Free MaxTime Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/maxprofile/setup/routes.lua"; http_uri; content:"action=enable_frontend_auth"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate the MaxTime management interface from untrusted networks.
2. Access Control: Implement IP whitelisting for the setup interface.
3. WAF Rules: Deploy web application firewall rules to block requests to /maxprofile/setup/routes.lua without authentication.

Long-Term Fix:

• Vendor Patch: Await an official patch from Q-Free. Contact vendor for updates.
• Code Fix: If source code is available, add authentication checks to the vulnerable function as shown in the patched code example.

Workaround:

• Disable remote access to the setup interface if not required.
• Monitor logs for suspicious activity.

Valters IT Signature
This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.