CVE-2025-1102

A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:*

History

24 Oct 2025, 14:58

Type	Values Removed	Values Added
Summary		(es) Un error de validación de origen CWE-346 "Origin Validation Error" en la configuración CORS en Q-Free MaxTime menor o igual a la versión 2.11.0 permite que un atacante remoto no autenticado afecte la confidencialidad, integridad o disponibilidad del dispositivo a través de URL manipulado o solicitudes HTTP.
CPE		cpe:2.3:a:q-free:maxtime::::::::
First Time		Q-free Q-free maxtime
References	~~() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102 -~~	() https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102 - Third Party Advisory

12 Feb 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-12 14:15

Updated : 2025-10-24 14:58

NVD link : CVE-2025-1102

Mitre link : CVE-2025-1102

CVE.ORG link : CVE-2025-1102

JSON object : View

Products Affected

q-free

maxtime

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2025-1102", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "prodsec@nozominetworks.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "published": "2025-02-12T14:15:31.943", "references": [{"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1102", "tags": ["Third Party Advisory"], "source": "prodsec@nozominetworks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "prodsec@nozominetworks.com", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "A CWE-346 \"Origin Validation Error\" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests."}, {"lang": "es", "value": "Un error de validaci\u00f3n de origen CWE-346 \"Origin Validation Error\" en la configuraci\u00f3n CORS en Q-Free MaxTime menor o igual a la versi\u00f3n 2.11.0 permite que un atacante remoto no autenticado afecte la confidencialidad, integridad o disponibilidad del dispositivo a trav\u00e9s de URL manipulado o solicitudes HTTP."}], "lastModified": "2025-10-24T14:58:28.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BCAC20E-CD58-4376-BD70-584BCC62FA4E", "versionEndIncluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "prodsec@nozominetworks.com"}