Q-Free MaxTime Missing Authentication Vulnerability Allowing User PIN Reset

A vulnerability allowing unauthenticated remote attackers to reset user PINs has been identified in Q-Free MaxTime versions through 2.11.0. This issue arises from a missing authentication for critical functions, specifically in the maxprofile/accounts/routes.lua file.

Impact

Exploitation of this vulnerability allows unauthorized access to user accounts by resetting PINs.

Remediation

Until a patch is released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.