Q-Free MaxTime Missing Authentication Vulnerability Allowing Unauthenticated Factory Reset

A vulnerability allowing unauthenticated remote attackers to factory reset devices running Q-Free MaxTime versions through 2.11.0 has been identified. This vulnerability, categorized as CWE-306 'Missing Authentication for Critical Function', resides in the file maxprofile/setup/routes.lua. Exploitation of this vulnerability erases all device configurations, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability allows for an unauthenticated remote factory reset of the device, erasing all configurations and causing a denial-of-service condition.

Remediation

Until an official patch is released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.