PT-2025-7147 · Q Free · Q-Free Maxtime

Diego Giubertoni + 1 · Published 2025-02-12 · Updated 2025-10-28 · CVE-2025-26358

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier

Description: The issue is related to improper input validation, allowing an authenticated remote attacker to modify system configuration via crafted HTTP requests. This can be achieved by sending manipulated requests to the system.

Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, update to a version later than 2.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the ldbMT.so module to minimize the risk of exploitation. Avoid using crafted HTTP requests to the affected system until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-26358

Affected Products

Q-Free Maxtime

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-26358 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26358 · Vendor Advisory
• https://t.me/cveNotify/137661 · Telegram Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2025-26358 · Note
• https://t.me/cveNotify/140684 · Telegram Post
• https://twitter.com/CVEnew/status/1889673447078240602 · Twitter Post
• https://t.me/cvedetector/17881 · Telegram Post