Q-Free MaxTime Missing Authentication Vulnerability in Authentication Profile Server

A vulnerability allowing missing authentication for critical functions has been identified in Q-Free MaxTime versions through 2.11.0. This issue resides in the maxprofile/setup/routes.lua file and allows an unauthenticated remote attacker to enable an authentication profile server by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability could lead to unauthorized activation of an authentication profile server, potentially allowing attackers to bypass authentication measures.

Remediation

While an official patch has not been released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.