Q-Free MaxTime Missing Authentication Vulnerability in Front Panel Authentication

A vulnerability allowing unauthenticated remote attackers to disable front panel authentication has been identified in Q-Free MaxTime versions through 2.11.0. This issue arises from a missing authentication for critical functions, specifically in the maxprofile/setup/routes.lua file. Exploitation of this vulnerability could make physical access to the device easier by bypassing front panel security measures.

Impact

Disabling front panel authentication could facilitate unauthorized physical access to the device by removing a layer of security.

Remediation

While an official patch has not been released, it is recommended to restrict and monitor network access to the management web application on devices running Q-Free MaxTime versions through 2.11.0.