CVE-2025-26370: Q-free Maxtime Auth Bypass Vulnerability

CVE-2025-26370 Overview

CVE-2025-26370 is a missing authorization vulnerability [CWE-862] in the maxprofile/user-groups/routes.lua component of Q-Free MaxTime. The flaw affects all versions up to and including 2.11.0. An authenticated low-privileged attacker can send crafted HTTP requests to remove privileges from user groups. The vulnerability does not require user interaction and is exploitable over the network.

Critical Impact
A low-privileged authenticated user can strip privileges from arbitrary user groups, disrupting role-based access control and potentially locking administrators out of MaxTime traffic management functionality.

Affected Products

Q-Free MaxTime versions <= 2.11.0
maxprofile/user-groups/routes.lua route handler
Deployments exposing the MaxTime web management interface

Discovery Timeline

2025-02-12 - CVE-2025-26370 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2025-26370

Vulnerability Analysis

The vulnerability resides in the route handler maxprofile/user-groups/routes.lua, which manages user group configuration in Q-Free MaxTime. The handler accepts requests that modify user group privileges without verifying that the requesting account holds an appropriate administrative role. Any authenticated session — including accounts intended for read-only or operator use — can invoke the privilege-removal action.

MaxTime is a traffic controller management application deployed in transportation infrastructure. Loss of integrity in its access control layer has operational consequences. An attacker can revoke privileges from groups that legitimate administrators rely on, creating a denial-of-service condition for management workflows while preserving their own access.

Root Cause

The root cause is missing server-side authorization checks [CWE-862]. The route enforces authentication but does not validate that the authenticated principal has the privileges required to mutate user group records. Authorization logic appears to be assumed at the UI layer rather than enforced at the API boundary.

Attack Vector

Exploitation requires network access to the MaxTime management interface and a valid set of low-privileged credentials. The attacker issues a crafted HTTP request directly to the user-groups route, bypassing the management UI controls that would normally restrict the action. No social engineering or additional payloads are required. Refer to the Nozomi Networks Vulnerability Advisory for transaction-level technical detail.

Detection Methods for CVE-2025-26370

Indicators of Compromise

HTTP requests to maxprofile/user-groups/routes endpoints originating from non-administrative user sessions.
Unexpected user group privilege changes recorded in MaxTime audit logs without a corresponding administrator action.
Repeated authenticated requests from a single session that mutate user group records in rapid succession.

Detection Strategies

Compare the session identity on user-group modification requests against the list of accounts authorized to perform privilege management.
Alert on any privilege removal event affecting administrative or operator groups within MaxTime.
Baseline normal administrative behavior and flag privilege mutations occurring outside scheduled maintenance windows.

Monitoring Recommendations

Forward MaxTime web server access logs and application audit logs to a centralized log platform for correlation.
Track authentication events alongside configuration changes to identify privilege escalations or unauthorized modifications.
Monitor for HTTP POST, PUT, or DELETE requests against user-groups routes from IP addresses not associated with administrative workstations.

How to Mitigate CVE-2025-26370

Immediate Actions Required

Restrict network access to the MaxTime management interface to trusted administrative networks only.
Audit existing MaxTime user accounts and disable any low-privileged accounts that are not actively required.
Review user group configurations and audit logs for unauthorized privilege changes prior to remediation.
Contact Q-Free for the fixed release and apply it once available.

Patch Information

Q-Free MaxTime versions through 2.11.0 are affected. Operators should consult Q-Free directly and reference the Nozomi Networks Vulnerability Advisory for current remediation guidance. Upgrade to a release where the maxprofile/user-groups/routes.lua handler enforces server-side authorization.

Workarounds

Place the MaxTime management interface behind a VPN or network access control list that restricts connectivity to administrator endpoints.
Apply the principle of least privilege when issuing MaxTime credentials and rotate any shared low-privileged accounts.
Enable verbose audit logging on user group changes and review the logs on a recurring schedule until a patched version is deployed.

bash

# Example: restrict MaxTime web interface to an administrative subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP