Q-Free MaxTime Password Reset Vulnerability in Users Routes

A missing authorization vulnerability has been identified in Q-Free MaxTime versions through 2.11.0. This vulnerability allows authenticated low-privileged attackers to reset passwords, including those of administrator accounts, by sending crafted HTTP requests.

Impact

Exploitation of this vulnerability allows low-privileged authenticated attackers to reset administrator passwords, potentially leading to full control over the system.

Remediation

Until an official patch is released, it is recommended to periodically review and verify the passwords of users, especially those with administrative privileges, on the management web application of devices running Q-Free MaxTime versions through 2.11.0. Additionally, review all accounts on the same management web application and delete any unnecessary ones.