CVE-2025-1102: Q-free Maxtime Auth Bypass Vulnerability

CVE-2025-1102 Overview

CVE-2025-1102 is an Origin Validation Error [CWE-346] in the Cross-Origin Resource Sharing (CORS) configuration of Q-Free MaxTime traffic controller software. The flaw affects all versions less than or equal to 2.11.0. An unauthenticated remote attacker can exploit the misconfigured CORS policy by sending crafted URLs or HTTP requests to a victim who interacts with attacker-controlled content. Successful exploitation impacts the confidentiality and integrity of the affected device. Q-Free MaxTime is used in intelligent transportation systems to manage traffic signal controllers, making this issue relevant to operational technology environments.

Critical Impact
An unauthenticated attacker can read and modify data on a Q-Free MaxTime device by tricking a user into visiting a crafted URL that abuses the CORS misconfiguration.

Affected Products

Q-Free MaxTime versions <= 2.11.0
Q-Free MaxTime traffic controller software deployments
Intelligent transportation system installations relying on MaxTime

Discovery Timeline

2025-02-12 - CVE-2025-1102 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1102

Vulnerability Analysis

The vulnerability resides in how Q-Free MaxTime validates the Origin header in HTTP requests sent to its web interface. CORS is designed to control which external origins may access resources served by a web application. When origin validation is too permissive or improperly implemented, browsers will allow cross-origin reads and state-changing requests that should be blocked. In MaxTime, the CORS policy fails to restrict untrusted origins, so a malicious site loaded by an authenticated or network-adjacent user can issue authorized requests to the device. The attacker can use this primitive to retrieve sensitive configuration data and to send commands that modify the controller state. User interaction is required, as the attack relies on the victim opening a crafted URL or loading attacker-controlled content from within the network where MaxTime is reachable.

Root Cause

The root cause is improper Origin Validation [CWE-346] within the CORS response headers. The application reflects or accepts untrusted origins in Access-Control-Allow-Origin while also permitting credentialed requests. This combination defeats the same-origin protections the browser would otherwise enforce.

Attack Vector

Exploitation requires the victim to interact with attacker content, typically by visiting a malicious webpage while having network reachability to a MaxTime device. The malicious page issues cross-origin XHR or fetch requests that the browser delivers because of the permissive CORS policy. The attacker reads responses containing device data and can submit configuration changes, harming confidentiality and integrity. Availability is not directly impacted according to the published CVSS vector.

No verified public proof-of-concept code is available. Refer to the Nozomi Networks Vulnerability Advisory for additional technical detail.

Detection Methods for CVE-2025-1102

Indicators of Compromise

Web server logs on MaxTime devices showing requests with Origin headers referencing unexpected external domains.
HTTP responses from MaxTime that include Access-Control-Allow-Origin values reflecting arbitrary origins together with Access-Control-Allow-Credentials: true.
Unexplained configuration changes on traffic controllers correlated with user web browsing activity.

Detection Strategies

Inspect HTTP traffic to MaxTime management interfaces and alert on cross-origin requests originating from non-allowlisted domains.
Audit MaxTime configuration history for unexpected changes that lack a corresponding administrative session from a trusted workstation.
Use network sensors to flag external referers pointing at MaxTime endpoints from outside the operations network.

Monitoring Recommendations

Forward MaxTime access logs to a centralized log platform and create rules for anomalous Origin or Referer headers.
Monitor user workstations with reachability to MaxTime for browser-initiated requests to controller IP addresses.
Baseline normal administrative source workstations and alert when controller traffic originates elsewhere.

How to Mitigate CVE-2025-1102

Immediate Actions Required

Upgrade Q-Free MaxTime to a version above 2.11.0 once the vendor-supplied fix is deployed.
Restrict network access to MaxTime management interfaces using firewall rules and management VLAN segmentation.
Require administrators to use dedicated workstations that do not browse the general internet.

Patch Information

Q-Free has been notified through the coordinated disclosure process documented in the Nozomi Networks Vulnerability Advisory. Apply the latest available MaxTime release from Q-Free that addresses CVE-2025-1102. Confirm the running version after upgrade and validate that the CORS policy no longer reflects arbitrary origins.

Workarounds

Place MaxTime devices behind a reverse proxy that enforces a strict Access-Control-Allow-Origin allowlist.
Block outbound internet access from operator workstations that manage MaxTime to prevent victim interaction with malicious content.
Terminate administrative sessions immediately after configuration tasks to limit the window where CORS abuse can leverage authenticated state.

bash

# Example reverse proxy CORS hardening (nginx)
add_header Access-Control-Allow-Origin "https://ops.example.internal" always;
add_header Access-Control-Allow-Credentials "true" always;
add_header Vary "Origin" always;
if ($http_origin !~* "^https://ops\.example\.internal$") {
    return 403;
}