CVE-2025-26345 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Q-Free. 📦 **Product**: MAXTIME Suite (Local traffic signal management). 📅 **Affected Versions**: **2.11.0 and earlier** versions.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🔑 **Auth**: **None required** (PR:N). 🌐 **Network**: Remote (AV:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: **No PoC provided** in the current data. ⚠️ **Risk**: Despite no public code, the low CVSS complexity suggests wild exploitation is likely imminent given the critical nature.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix Status**: **Patch available** implied by CVE publication. 🔄 **Action**: Upgrade to a version **newer than 2.11.0**. 📝 **Reference**: Check Nozomi Networks advisory for specific patch details.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 📈 **Priority**: **P0**. ⏱️ **Reason**: CVSS Score is **9.8** (Critical). Remote, unauthenticated, high impact. Immediate patching or isolation is required.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical Access Control Error in Q-Free MAXTIME Suite. <br>💥 **Consequences**: Attackers can manipulate user group permissions via crafted HTTP requests.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Q-Free. <br>📦 **Product**: MAXTIME Suite (Local traffic signal management). <br>📅 **Affected Versions**: **2.11.0 and earlier** versions.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Edit **user group permissions**. <br>🔓 **Privileges**: Gains ability to modify critical system configurations without authentication.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔑 **Auth**: **None required** (PR:N). <br>🌐 **Network**: Remote (AV:N). <br>🎯 **Complexity**: Low (AC:L). Easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: **No PoC provided** in the current data. <br>⚠️ **Risk**: Despite no public code, the low CVSS complexity suggests wild exploitation is likely imminent given the critical nature.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for Q-Free MAXTIME Suite instances. <br>📡 **Feature**: Look for exposed `maxprofile/menu/routes.lua` endpoints.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix Status**: **Patch available** implied by CVE publication. <br>🔄 **Action**: Upgrade to a version **newer than 2.11.0**. <br>📝 **Reference**: Check Nozomi Networks advisory for specific patch details.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Implement **Network Segmentation**. <br>🛑 **Mitigation**: Block external access to the MAXTIME Suite management interface.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>📈 **Priority**: **P0**. <br>⏱️ **Reason**: CVSS Score is **9.8** (Critical). Remote, unauthenticated, high impact. Immediate patching or isolation is required.

Continue exploring

Vulnerability detail Full AI analysis (login) Q-Free CWE-306