CVE-2025-26360 Overview
CVE-2025-26360 is a missing authentication vulnerability [CWE-306] in Q-Free MaxTime traffic management software. The flaw resides in the maxprofile/persistance/routes.lua route handler and affects all versions up to and including 2.11.0. An unauthenticated remote attacker can send crafted HTTP requests to delete dashboards without providing credentials. The vulnerability impacts data integrity in the MaxTime application by permitting destructive actions against dashboard resources through exposed routes that fail to enforce authentication checks.
Critical Impact
Unauthenticated remote attackers can delete MaxTime dashboards by sending crafted HTTP requests, disrupting traffic management operations and destroying configured monitoring views.
Affected Products
- Q-Free MaxTime versions less than or equal to 2.11.0
- The maxprofile/persistance/routes.lua component
- Deployments exposing MaxTime HTTP endpoints to untrusted networks
Discovery Timeline
- 2025-02-12 - CVE-2025-26360 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26360
Vulnerability Analysis
The vulnerability exists in the routing logic implemented in maxprofile/persistance/routes.lua. This Lua route handler exposes dashboard management functionality over HTTP. The handler responsible for dashboard deletion does not verify whether the request originates from an authenticated session. As a result, any client capable of reaching the MaxTime web service can invoke the deletion endpoint. The issue is classified as Missing Authentication for Critical Function [CWE-306], where security-sensitive operations are exposed without an authentication barrier. Successful exploitation removes dashboards used by operators to monitor traffic systems, degrading visibility and requiring manual reconstruction of deleted resources.
Root Cause
The root cause is the absence of an authentication check in the Lua route that handles dashboard deletion requests. The route accepts and processes destructive HTTP verbs without validating a session token, cookie, or authorization header. Q-Free MaxTime treats the deletion path as if it were a public resource, delegating no gatekeeping to middleware or the handler itself.
Attack Vector
An attacker sends a crafted HTTP request to the vulnerable dashboard deletion endpoint on a reachable MaxTime instance. No credentials, user interaction, or prior access are required. The attack originates over the network, and the exploit complexity is low. Because MaxTime is deployed in traffic management environments, exposure of the management interface to any routable network segment is sufficient for exploitation. Consult the Nozomi Networks Vulnerability Advisory for technical validation details.
No public proof-of-concept code has been published. The vulnerability manifests when an HTTP DELETE or equivalent request reaches the dashboard route without authentication middleware intercepting it.
Detection Methods for CVE-2025-26360
Indicators of Compromise
- HTTP requests to maxprofile/persistance/routes paths originating from unauthenticated sessions or unexpected source IPs
- Sudden disappearance of previously configured dashboards in MaxTime without corresponding administrator activity
- Web server access logs showing DELETE method calls against dashboard endpoints outside of normal operator working hours
Detection Strategies
- Review MaxTime web server access logs for requests to /maxprofile/persistance/routes endpoints and correlate with authenticated session identifiers
- Deploy network monitoring rules on HTTP traffic destined for MaxTime hosts and alert on DELETE requests from non-administrative subnets
- Compare periodic snapshots of dashboard inventories to detect unauthorized removal events
Monitoring Recommendations
- Forward MaxTime application and web server logs to a centralized logging platform for retention and correlation
- Alert on any HTTP request to the dashboard routes lacking a valid authenticated session cookie or token
- Baseline normal administrative activity and flag deviations in request volume, source, and method
How to Mitigate CVE-2025-26360
Immediate Actions Required
- Restrict network access to MaxTime management interfaces using firewall rules or VPN gating, limiting reachability to trusted operator subnets
- Audit dashboard inventories and back up current configurations to enable recovery if deletion occurs
- Contact Q-Free support to confirm patch availability and upgrade guidance for versions above 2.11.0
Patch Information
Q-Free MaxTime versions up to and including 2.11.0 are affected. Refer to the Nozomi Networks Vulnerability Advisory and Q-Free vendor communications for the fixed release version. Apply the vendor-supplied update as soon as it is available in your environment.
Workarounds
- Place MaxTime behind a reverse proxy that enforces authentication before requests reach the maxprofile/persistance/routes endpoints
- Apply network ACLs to block inbound HTTP requests from untrusted networks to the MaxTime service port
- Disable or remove exposure of the vulnerable route where feasible until the vendor patch is deployed
# Example: restrict MaxTime HTTP access to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
