CVE-2025-26373 Overview
CVE-2025-26373 is a missing authorization vulnerability in Q-Free MaxTime, a traffic management software platform. The flaw resides in the maxprofile/users/routes.lua user endpoint and affects all versions up to and including 2.11.0. An authenticated attacker with low privileges can enumerate users on the system through crafted HTTP requests. The vulnerability is tracked under [CWE-862] (Missing Authorization) and stems from inadequate access control checks on a user-facing API route.
Critical Impact
Low-privileged authenticated attackers can enumerate user accounts in Q-Free MaxTime deployments, exposing information useful for subsequent credential attacks and lateral movement within traffic management infrastructure.
Affected Products
- Q-Free MaxTime versions ≤ 2.11.0
- Component: maxprofile/users/routes.lua user endpoint
- Deployments exposing the MaxTime web interface to authenticated users
Discovery Timeline
- 2025-02-12 - CVE-2025-26373 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26373
Vulnerability Analysis
The vulnerability exists in the user management functionality of Q-Free MaxTime. The maxprofile/users/routes.lua module exposes an endpoint that returns user information without verifying whether the requesting account holds the required authorization level. Any authenticated session, including accounts with minimal privileges, can invoke the endpoint and retrieve data about other users on the system.
User enumeration flaws undermine the confidentiality boundary between accounts in a multi-user system. Attackers who harvest valid usernames can target those accounts with password spraying, brute-force attempts, or social engineering. In an operational technology context such as traffic signal management, this reconnaissance step frequently precedes attempts to escalate privilege or reach safety-critical functions.
See the Nozomi Networks Vulnerability Advisory for additional technical detail on the affected endpoint.
Root Cause
The root cause is a missing authorization check in the Lua route handler for the users resource. The endpoint authenticates the request but does not verify that the caller has the role or permission required to view user records. This represents a classic broken access control pattern where authentication is conflated with authorization.
Attack Vector
The vulnerability is exploited over the network against the MaxTime web interface. An attacker first obtains any valid low-privileged credential, then issues HTTP requests to the vulnerable maxprofile/users/routes endpoint. The server returns user information that should be restricted to administrative roles. No user interaction or elevated privileges are required beyond initial authentication.
No public proof-of-concept exploit code is available at this time. Refer to the vendor advisory for details on the request structure and response payload.
Detection Methods for CVE-2025-26373
Indicators of Compromise
- HTTP requests from low-privileged user sessions targeting the maxprofile/users/routes endpoint
- Unusual volumes of GET requests to user listing or user profile URIs from a single authenticated session
- Successful user data responses correlated with non-administrative account identifiers in server logs
Detection Strategies
- Review MaxTime web server access logs for requests to user management endpoints originating from non-administrative accounts
- Baseline normal user endpoint access patterns and alert on deviations such as sequential enumeration behavior
- Correlate authentication events with subsequent user endpoint access to identify reconnaissance activity following credential compromise
Monitoring Recommendations
- Enable verbose HTTP request logging on the MaxTime application server, including authenticated user identity per request
- Forward application and web server logs to a centralized analytics platform for correlation and retention
- Monitor for failed authentication bursts preceding successful logins, which may indicate credential stuffing informed by prior enumeration
How to Mitigate CVE-2025-26373
Immediate Actions Required
- Inventory all Q-Free MaxTime deployments and identify instances running version 2.11.0 or earlier
- Restrict network access to the MaxTime management interface to trusted administrative networks only
- Audit existing user accounts and remove or disable unnecessary low-privileged accounts that could be abused for authenticated access
- Rotate credentials for accounts that may have been exposed through enumeration
Patch Information
Consult the Nozomi Networks Vulnerability Advisory and contact Q-Free directly for the current fixed version and patch availability. Apply vendor-supplied updates to any MaxTime deployment at version 2.11.0 or earlier.
Workarounds
- Place the MaxTime web interface behind a VPN or reverse proxy that enforces additional authentication and access control
- Apply network segmentation to isolate traffic management systems from general-purpose corporate networks
- Enforce the principle of least privilege for all MaxTime accounts and remove shared or default credentials
# Example: restrict access to the MaxTime management interface at the network edge
# Replace with your management subnet and MaxTime host
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.