CVE-2025-26366

Executive Summary

CVE-2025-26366 is a critical authentication bypass vulnerability in Q-Free MaxTime, a traffic management system. The flaw resides in the maxprofile/setup/routes.lua file, where a critical function lacks proper authentication checks. An unauthenticated, remote attacker can send crafted HTTP requests to disable front panel authentication, effectively bypassing the device's primary security control. This allows an attacker to gain administrative access to the device's web interface without valid credentials.

The vulnerability is classified as CWE-306: Missing Authentication for Critical Function. With a CVSS score of 7.5 (High), the impact is significant due to the low attack complexity and network-based attack vector. No authentication is required, and no user interaction is needed. The attack can compromise the integrity of the system by disabling authentication, but confidentiality and availability are not directly affected.

No public proof-of-concept (PoC) code or exploit is currently available. The vendor, Q-Free, has not released a patch, and the status remains UNKNOWN/UNPATCHED. This report provides a comprehensive technical analysis, detection methods, and mitigation strategies for this vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector (AV): Network (N) - Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) - No direct data disclosure.
• Integrity (I): High (H) - The attacker can disable authentication, a critical security function.
• Availability (A): None (N) - No direct denial of service.

Threat Level: High. The vulnerability is trivial to exploit (no auth, low complexity) and allows an attacker to completely bypass the device's authentication mechanism. This can lead to full administrative control of the Q-Free MaxTime device.

Deep Dive & Mechanics

The vulnerability is located in the maxprofile/setup/routes.lua file of Q-Free MaxTime. This file likely defines the routing logic for the web application's setup or configuration interface. The specific function that handles the disabling of front panel authentication does not verify the user's session or authentication status before executing the action.

Mechanism:

1. The web application exposes an endpoint (likely /maxprofile/setup/routes.lua or a related path) that accepts HTTP requests to modify authentication settings.
2. The vulnerable code path does not check for a valid session token, API key, or any other form of authentication.
3. An attacker sends a crafted HTTP request (e.g., a POST request with a specific parameter like disable_auth=true) to this endpoint.
4. The server processes the request and disables the front panel authentication, allowing subsequent access to the administrative interface without credentials.

The root cause is a classic CWE-306: Missing Authentication for Critical Function. The developer assumed that only authenticated users would reach this endpoint, but no enforcement mechanism was implemented.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

-- maxprofile/setup/routes.lua (Vulnerable)
function handle_disable_auth(request)
    -- No authentication check here
    local success = disable_front_panel_auth()
    if success then
        return "Authentication disabled"
    else
        return "Failed to disable authentication"
    end
end

Patched Code (Conceptual):

-- maxprofile/setup/routes.lua (Patched)
function handle_disable_auth(request)
    -- Authentication check added
    if not is_authenticated(request) then
        return "Unauthorized", 401
    end
    local success = disable_front_panel_auth()
    if success then
        return "Authentication disabled"
    else
        return "Failed to disable authentication"
    end
end

The patched version adds a call to is_authenticated(request) which verifies the user's session or credentials before allowing the critical function to execute.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a Q-Free MaxTime device or a virtual instance (version <= 2.11.0).
2. Ensure the web interface is accessible on the network (default port 80 or 443).
3. Use a tool like curl, Burp Suite, or a custom Python script.

Exploitation Steps:

1. Identify the target endpoint. Based on the file path, the likely endpoint is /maxprofile/setup/routes.lua or a related route.
2. Send a crafted HTTP request to disable authentication. The exact parameter is unknown, but a common pattern is:

   curl -X POST http://target/maxprofile/setup/routes.lua \
     -d "action=disable_auth&confirm=true"
   

3. If successful, the server responds with a success message.
4. Now, access the administrative interface without authentication:

   curl http://target/admin/
   

5. The attacker now has full administrative access.

Alternative Exploit (Python):

import requests

target = "http://target"
url = f"{target}/maxprofile/setup/routes.lua"
data = {"action": "disable_auth", "confirm": "true"}
response = requests.post(url, data=data)
if "Authentication disabled" in response.text:
    print("Authentication bypassed!")
    # Now access admin interface
    admin_response = requests.get(f"{target}/admin/")
    print(admin_response.text)
else:
    print("Exploit failed")

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /maxprofile/setup/routes.lua with unusual parameters (e.g., action=disable_auth).
• Alert on any successful response containing "Authentication disabled" from that endpoint.
• Monitor for subsequent access to /admin/ or other privileged paths without prior authentication.

Hunting:

• Search web server logs for POST requests to /maxprofile/setup/routes.lua from IPs not in the trusted admin list.
• Look for patterns of requests that attempt to disable authentication (e.g., multiple requests with different parameter names).

Mitigation:

• Immediately restrict network access to the Q-Free MaxTime device to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block requests to /maxprofile/setup/routes.lua with suspicious parameters.
• Monitor for any unauthorized changes to authentication settings.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /maxprofile/setup/routes.lua with parameters like action=disable_auth or disable_auth=true.
  • HTTP responses containing the string "Authentication disabled" from the vulnerable endpoint.
  • Subsequent HTTP requests to /admin/ or other privileged paths without a valid session cookie.

• Host IOCs:

  • Changes to the Q-Free MaxTime configuration files (e.g., auth_enabled=false or similar).
  • Unauthorized user accounts or modified access control lists.
  • Log entries showing authentication bypass events (if logging is enabled).

• File IOCs:

  • Modification timestamp of maxprofile/setup/routes.lua (if an attacker uploads a malicious version).
  • Presence of new files in the web root directory.

Detection Engineering

YARA Rule

rule CVE_2025_26366_QFree_MaxTime_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-26366 in Q-Free MaxTime"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26366"
        severity = "high"
    strings:
        $s1 = "disable_auth" ascii wide nocase
        $s2 = "action=disable_auth" ascii wide nocase
        $s3 = "Authentication disabled" ascii wide nocase
        $s4 = "/maxprofile/setup/routes.lua" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: CVE-2025-26366 Q-Free MaxTime Authentication Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-26366 to disable authentication on Q-Free MaxTime.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26366
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxprofile/setup/routes.lua'
        cs-uri-query|contains: 'disable_auth'
    condition: selection
falsepositives:
    - Legitimate administrative actions from trusted IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26366 Q-Free MaxTime Authentication Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"/maxprofile/setup/routes.lua"; http_uri; content:"disable_auth"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate Q-Free MaxTime devices on a separate VLAN with strict firewall rules. Only allow access from trusted administrative IPs.
2. Disable Unnecessary Services: If the web interface is not required, disable it or restrict it to localhost only.
3. Web Application Firewall (WAF): Deploy a WAF rule to block POST requests to /maxprofile/setup/routes.lua containing disable_auth or similar parameters.
4. Monitor Logs: Enable detailed logging on the web server and monitor for suspicious requests.

Long-Term Fixes:

1. Vendor Patch: Contact Q-Free for an official patch. Since the status is UNKNOWN/UNPATCHED, consider alternative solutions.
2. Code Hardening: If source code is available, implement authentication checks on all critical functions as shown in the patched code example.
3. Upgrade: If a patched version becomes available, upgrade immediately.
4. Compensating Controls: Implement multi-factor authentication (MFA) at the network level (e.g., VPN) to access the device.

Workaround:

• Manually edit the routes.lua file to add an authentication check (if you have access to the device's filesystem). This is risky and may break functionality.

Valters IT
Securing Digital Infrastructure