CVE-2025-26366 Overview
CVE-2025-26366 is a missing authentication vulnerability [CWE-306] in Q-Free MaxTime traffic controller software. The flaw exists in the maxprofile/setup/routes.lua component in versions less than or equal to 2.11.0. An unauthenticated remote attacker can send crafted HTTP requests to disable front panel authentication on affected devices. The vulnerability impacts the integrity of the device configuration without requiring user interaction or prior credentials.
Critical Impact
Remote attackers can disable front panel authentication on Q-Free MaxTime traffic controllers over the network, removing a key access control on intersection management hardware.
Affected Products
- Q-Free MaxTime versions <= 2.11.0
- maxprofile/setup/routes.lua component
- Q-Free traffic controller deployments exposing the MaxTime web interface
Discovery Timeline
- 2025-02-12 - CVE-2025-26366 published to NVD
- 2025-10-28 - Last updated in NVD database
Technical Details for CVE-2025-26366
Vulnerability Analysis
The vulnerability resides in the routes.lua file under the maxprofile/setup/ directory of Q-Free MaxTime. Routes handling front panel authentication settings lack server-side authentication checks. An attacker who can reach the HTTP service can invoke administrative routes that should be restricted to authenticated operators.
Disabling front panel authentication allows physical operators to access controller functionality without entering credentials. Combined with physical access to the intersection cabinet, this expands the local attack surface significantly. The remote precondition is solely network reachability to the MaxTime HTTP endpoint.
Root Cause
The root cause is a missing authentication check on a critical function [CWE-306]. The Lua route handler responsible for toggling front panel authentication does not validate session state or user role before processing the request. Authorization is assumed but never enforced at the route layer.
Attack Vector
Exploitation requires only network access to the MaxTime web service. An attacker sends a crafted HTTP request to the vulnerable route in maxprofile/setup/routes.lua to flip the front panel authentication setting to disabled. No credentials, tokens, or user interaction are required. Refer to the Nozomi Networks Advisory for the technical write-up.
Detection Methods for CVE-2025-26366
Indicators of Compromise
- Unexpected HTTP requests to maxprofile/setup/ routes from external or non-administrative source addresses.
- Front panel authentication setting changes that do not correlate with an authenticated operator session.
- HTTP POST or PUT traffic to MaxTime endpoints originating outside designated management subnets.
Detection Strategies
- Inspect MaxTime web server access logs for requests targeting setup routes without a preceding authenticated session.
- Baseline configuration state of front panel authentication and alert on changes outside scheduled maintenance windows.
- Deploy network monitoring on operational technology segments to flag HTTP traffic to MaxTime devices from unauthorized hosts.
Monitoring Recommendations
- Forward MaxTime HTTP and configuration audit logs to a central SIEM or data lake for correlation.
- Monitor for repeated probing of /maxprofile/setup/ paths, which indicates reconnaissance.
- Track configuration drift on traffic controller fleets and alert on authentication setting downgrades.
How to Mitigate CVE-2025-26366
Immediate Actions Required
- Restrict network access to MaxTime HTTP services using firewall rules or ACLs that allow only trusted management hosts.
- Audit current front panel authentication settings on all Q-Free MaxTime devices and re-enable where disabled.
- Place MaxTime controllers behind a VPN or jump host instead of exposing them directly to corporate or public networks.
Patch Information
Q-Free MaxTime versions <= 2.11.0 are affected. Operators should contact Q-Free for a fixed release and apply it across the fleet. Refer to the Nozomi Networks Advisory for vendor coordination details.
Workarounds
- Segment traffic controllers onto isolated VLANs with strict ingress filtering on HTTP ports.
- Disable the MaxTime web management interface on devices that do not require remote configuration.
- Enforce physical security controls on intersection cabinets to mitigate downstream impact if front panel authentication is bypassed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
