Q-Free MaxTime Missing Authentication Vulnerability in Authentication Profile Management

A vulnerability allowing unauthenticated remote attackers to manipulate authentication profiles on Q-Free MaxTime versions through 2.11.0 has been identified. This issue arises from a missing authentication requirement for critical functions, specifically in the maxprofile/setup/routes.lua file. Exploitation can be achieved by sending crafted HTTP requests to the server, potentially bypassing authentication mechanisms.

Impact

Exploitation of this vulnerability allows an unauthenticated remote attacker to set arbitrary authentication profiles on the server, potentially bypassing authentication requirements.

Remediation

While an official patch has not been released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.