Q-Free MaxTime Username Enumeration Vulnerability

A vulnerability allowing username enumeration has been identified in Q-Free MaxTime versions through 2.11.0. This issue arises from an observable response discrepancy on the login page, which enables unauthenticated remote attackers to identify valid usernames by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability allows for the enumeration of valid usernames, which could be used to facilitate brute-force or credential-stuffing attacks.

Remediation

While an official solution has not been provided by the vendor, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.