PT-2025-6831 · Q Free · Q-Free Maxtime

Andrea Palanca + 1 · Publicado 2025-02-11 · Atualizado 2025-02-12 · CVE-2025-1100

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Q-Free MaxTime versions less than or equal to 2.11.0

Description The issue is related to a hard-coded password for the root account, allowing an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH. This enables the attacker to gain full control of the system.

Recommendations For Q-Free MaxTime versions less than or equal to 2.11.0, update to a version greater than 2.11.0 to resolve the issue. As a temporary workaround, consider disabling SSH access to the root account until a patch is available. Restrict access to the system to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-259

Identificadores relacionados

BDU:2025-11396

CVE-2025-1100

Produtos afetados

Q-Free Maxtime

Referências · 6

• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-1100 · Nota
• https://twitter.com/CVEnew/status/1889673471774351452 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-1100 · Aviso do Fabricante
• https://q-free.com/product/intelight-maxtime · Nota
• https://bdu.fstec.ru/vul/2025-11396 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-1100 · Nota de Segurança