Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-26347 โ€” AI Deep Analysis Summary

CVSS 9.8 ยท Critical

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: Critical Access Control Error in Q-Free MAXTIME Suite.โ€ฆ
Read full answer (login)

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: **CWE-306** (Missing Authentication for Critical Function).โ€ฆ
Read full answer (login)

Q3Who is affected? (Versions/Components)

๐Ÿข **Affected Vendor**: Q-Free. <br>๐Ÿ“ฆ **Product**: MAXTIME Suite (Local Traffic Signal Management). <br>๐Ÿ“… **Versions**: **2.11.0 and earlier** versions are vulnerable.

Q4What can hackers do? (Privileges/Data)

๐Ÿ’ป **Attacker Actions**: <br>1. Edit **User Permissions** directly. <br>2. Escalate privileges to admin levels. <br>3. Modify traffic signal logic/routes. <br>4.โ€ฆ
Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

โšก **Exploitation Threshold**: **LOW**. <br>๐Ÿ”“ **Auth**: None required (**PR:N** - Privileges Required: None). <br>๐ŸŒ **Network**: Remote (**AV:N**). <br>๐Ÿ‘ค **User Interaction**: None (**UI:N**).โ€ฆ
Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ“œ **Public Exploit**: **No**. <br>๐Ÿšซ **PoC**: The `pocs` field is empty in the provided data.โ€ฆ
Read full answer (login)

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check Method**: <br>1. Scan for **Q-Free MAXTIME Suite** services. <br>2. Verify version is **โ‰ค 2.11.0**. <br>3. Test access to `maxprofile/menu/routes.lua` endpoints without credentials. <br>4.โ€ฆ
Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿฉน **Official Fix**: **Yes**. <br>๐Ÿ“ข **Action**: Upgrade to a version **newer than 2.11.0**. <br>๐Ÿ”— **Reference**: Nozomi Networks Advisory provides details on the vulnerability and remediation steps.

Q9What if no patch? (Workaround)

๐Ÿ›‘ **No Patch Workaround**: <br>1. **Network Segmentation**: Isolate the traffic management system from untrusted networks. <br>2. **WAF Rules**: Block direct access to `.lua` script endpoints. <br>3.โ€ฆ
Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

๐Ÿ”ฅ **Urgency**: **CRITICAL (Priority 1)**. <br>๐Ÿšจ **Reason**: CVSS **9.8** (Critical). Remote, unauthenticated, low complexity.โ€ฆ
Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) Q-Free CWE-306