CVE-2025-1102

A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-02-12 14:15

Updated : 2025-10-24 14:58

NVD link : CVE-2025-1102

Mitre link : CVE-2025-1102

CVE.ORG link : CVE-2025-1102

JSON object : View

Products Affected

q-free

maxtime

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2025-1102", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "published": "2025-02-12T14:15:31.943", "references": [{"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "A CWE-346 \"Origin Validation Error\" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests."}, {"lang": "es", "value": "Un error de validaci\u00f3n de origen CWE-346 \"Origin Validation Error\" en la configuraci\u00f3n CORS en Q-Free MaxTime menor o igual a la versi\u00f3n 2.11.0 permite que un atacante remoto no autenticado afecte la confidencialidad, integridad o disponibilidad del dispositivo a trav\u00e9s de URL manipulado o solicitudes HTTP."}], "lastModified": "2025-10-24T14:58:28.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BCAC20E-CD58-4376-BD70-584BCC62FA4E", "versionEndIncluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}