Q-Free MaxTime Hard-Coded Password Vulnerability in Root Account Allowing Arbitrary Code Execution via SSH

A vulnerability exists in Q-Free MaxTime versions through 2.11.0, where a hard-coded password for the root account enables unauthenticated remote attackers to execute arbitrary code with root privileges via SSH.

Impact

Exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges, potentially leading to a full system compromise.

Remediation

While an official patch has not been released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.