Q-Free

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to a missing authentication for a critical function in the maxprofile/accounts/routes.lua file. This allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests. Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/accounts/routes.lua file to prevent unauthorized PIN resets.

**Name of the Vulnerable Software and Affected Versions** Q-Free MaxTime version 2.11.0 and earlier **Description** A CWE-346 "Origin Validation Error" in the CORS configuration allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests. **Recommendations** For Q-Free MaxTime version 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the CORS configuration to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Q-Free MaxTime versions less than or equal to 2.11.0 **Description** A "Observable Response Discrepancy" in the login page allows an unauthenticated remote attacker to enumerate valid usernames via crafted HTTP requests. This issue is related to the login functionality, where differences in response can reveal whether a username is valid or not. **Recommendations** For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the login page to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to improper input validation, allowing an authenticated remote attacker to modify system configuration via crafted HTTP requests. This can be achieved by sending manipulated requests to the system. Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the ldbMT.so module to minimize the risk of exploitation. Avoid using crafted HTTP requests to the affected system until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to missing authentication for a critical function, allowing an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests. This is due to a problem in the maxprofile/accounts/routes.lua file. Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/accounts/routes.lua file until a patch is available.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to a missing authentication for a critical function in the maxprofile/accounts/routes.lua file. This allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests. Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/accounts/routes.lua file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0 Description: A weak authentication issue in the PIN authentication mechanism allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests. This issue affects Q-Free MaxTime, enabling attackers to potentially gain unauthorized access. Recommendations: For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the PIN authentication mechanism to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: A missing authentication issue for a critical function in maxtime/handleRoute.lua allows an unauthenticated remote attacker to affect device confidentiality, integrity, or availability via crafted HTTP requests. Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `handleRoute.lua` function until a patch is available. Avoid using the vulnerable function to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0 Description: The issue is related to the use of a hard-coded cryptographic key in the JWT signing process. This allows an unauthenticated remote attacker to bypass authentication by sending crafted HTTP requests. Recommendations: For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the JWT signing process until a patch is available.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as SQL injection. This occurs in the maxprofile/menu/model.lua file, specifically at the editUserGroupMenu endpoint. An authenticated remote attacker can exploit this to execute arbitrary SQL commands via crafted HTTP requests. Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the editUserGroupMenu endpoint until a patch is available. Avoid using the vulnerable maxprofile/menu/model.lua file, specifically the editUserGroupMenu endpoint, until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: A missing authentication issue for a critical function in maxprofile/menu/routes.lua allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests. Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version that includes the necessary authentication for critical functions to prevent unauthorized access. As a temporary workaround, consider restricting access to the maxprofile/menu/routes.lua module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as SQL Injection. This occurs in the maxprofile/menu/model.lua file, specifically at the editUserMenu endpoint. An authenticated remote attacker can exploit this to execute arbitrary SQL commands via crafted HTTP requests. Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the editUserMenu endpoint in maxprofile/menu/model.lua to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0 Description: A Relative Path Traversal issue in the file upload mechanism allows an authenticated remote attacker to overwrite arbitrary files via crafted HTTP requests. This issue affects Q-Free MaxTime, enabling attackers to manipulate the system by sending specifically designed requests. Recommendations: For Q-Free MaxTime versions less than or equal to 2.11.0, consider restricting access to the file upload mechanism until a patch is available. As a temporary workaround, limit the ability to upload files to only necessary users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions less than or equal to 2.11.0 Description: The issue allows an authenticated remote attacker to upload malicious files via crafted HTTP requests due to an unrestricted upload of files with dangerous types in the template file uploads. Recommendations: For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the template file uploads to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: A Path Traversal issue in the template download mechanism allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. This issue enables the attacker to access confidential files through manipulated HTTP requests. Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the template download mechanism to minimize the risk of exploitation. Avoid using the vulnerable template download feature until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: A Path Traversal issue in the template deletion mechanism allows an authenticated remote attacker to delete sensitive files via crafted HTTP requests. Recommendations: For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the template deletion mechanism to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions prior to 2.11.0 Description: A Path Traversal issue in maxtime/api/sql/sql.lua allows an authenticated remote attacker to read sensitive files via crafted HTTP requests. Recommendations: For versions prior to 2.11.0, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxtime/api/sql/sql.lua module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to missing authentication for a critical function, allowing an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests. This is due to a missing authentication check in the maxprofile/guest-mode/routes.lua file. Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/guest-mode/routes.lua file to prevent exploitation.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to a missing authentication for a critical function in the maxprofile/menu/routes.lua file. This allows an unauthenticated remote attacker to edit user group permissions via crafted HTTP requests. Recommendations: For versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/menu/routes.lua file to prevent unauthorized edits to user group permissions.

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier Description: The issue is related to a missing authentication for a critical function in the maxprofile/persistance/routes.lua file. This allows an unauthenticated remote attacker to delete dashboards via crafted HTTP requests. Recommendations: For versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the maxprofile/persistance/routes.lua file to prevent unauthorized deletion of dashboards.