CVE-2025-26350 is an unrestricted file upload flaw (CWE-434) in Q-Free MaxTime, traffic signal controller software from Q-Free, a Norwegian intelligent transportation systems (ITS) vendor: an authenticated remote attacker can upload malicious files through MaxTime's template file upload feature, potentially overwriting arbitrary files and leading to system compromise or denial of service on version 2.11.0 and earlier. NVD rates it 8.8 (high) on CVSS v3.1, considerably higher than the discovering researcher's own 4.9 rating.
Vulnerability summary
8.8
High
0.9%
EPSS score (FIRST)
No
CISA KEV catalog
2025-02-12
Published
Vulnerability ID: CVE-2025-26350 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Q-Free MaxTime traffic signal controller software | cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:* | Q-Free MaxTime version 2.11.0 and earlier, per Nozomi Networks Labs CVE-2025-26350 advisory |
What does this mean for affected devices?
CVE-2025-26350 (CWE-434, unrestricted upload of file with dangerous type) affects Q-Free MaxTime. Q-Free AS is "a Norwegian technology company headquartered in Trondheim, Norway, specializing in intelligent transportation systems (ITS)" that "develops hardware and software solutions for electronic toll collection, traffic management, traffic signal control, and road user charging," and lists MAXTIME among its product lines (Wikipedia — Q-Free).
NVD's description states: "A CWE-434 'Unrestricted Upload of File with Dangerous Type' in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests" (NVD).
NVD records a Primary CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-reachable with only low privileges required and full confidentiality, integrity and availability impact. Nozomi Networks, the firm that discovered and reported the flaw, instead publishes a Secondary score of 4.9, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, treating the required privilege level as high and the impact as integrity-only; NVD's Primary rating is the authoritative score for this page (NVD).
Nozomi Networks' advisory states that an authenticated remote attacker "may overwrite arbitrary files, potentially leading to system compromise or denial of service," that the issue affects "Q-Free MaxTime less than or equal to version 2.11.0," and that "an official solution has not been communicated by the vendor" as of the advisory's issue date of February 11, 2025 (Nozomi Networks Labs — CVE-2025-26350).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0088 (59.3th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Agencies operating Q-Free MaxTime traffic signal controllers at or below version 2.11.0 should restrict network access to the management web application, since no official vendor patch is available, and should monitor for the vendor's remediation guidance.
Evidence
- A CWE-434 unrestricted file upload in the template file uploads of Q-Free MaxTime version 2.11.0 and earlier allows an authenticated remote attacker to upload malicious files via crafted HTTP requests. — NVD
- NVD Primary CVSS v3.1 score 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; Nozomi Networks' own Secondary score is 4.9, vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N. — NVD
- An authenticated remote attacker may overwrite arbitrary files, potentially leading to system compromise or denial of service; no official vendor solution had been communicated as of the February 11, 2025 issue date. — Nozomi Networks Labs — CVE-2025-26350
- Q-Free AS is a Norwegian ITS vendor that develops hardware and software for traffic management and traffic signal control, and lists MAXTIME among its products. — Wikipedia — Q-Free
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0088 (59.3th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
Does an attacker need credentials to exploit CVE-2025-26350, and what can they do with it?
Yes, the attacker must already be authenticated; from there, crafted HTTP requests to MaxTime's template file upload feature let them upload malicious files that may overwrite arbitrary files on the traffic signal controller, potentially leading to system compromise or denial of service (per NVD; per Nozomi Networks Labs — CVE-2025-26350).
Why do NVD and the discovering researcher disagree on how severe this is?
NVD's Primary CVSS v3.1 score is 8.8 (high), treating the required privilege level as low and the impact as full confidentiality/integrity/availability; Nozomi Networks, which discovered and reported the flaw, instead publishes a Secondary score of 4.9, treating the privilege requirement as high and the impact as integrity-only — NVD's Primary rating is the authoritative score for this page (per NVD; per Nozomi Networks Labs — CVE-2025-26350).
Is a vendor patch available for CVE-2025-26350?
No. Nozomi Networks' advisory, issued February 11, 2025, states that 'an official solution has not been communicated by the vendor' as of that date, so affected agencies should restrict network access to the management web application in the meantime (per Nozomi Networks Labs — CVE-2025-26350).
Is this related to any other Q-Free MaxTime vulnerability?
Yes, the sibling advisory CVE-2025-26378, disclosed the same day and affecting the same version range (2.11.0 and earlier), is a missing-authorization flaw that lets a low-privileged attacker reset any account's password, including administrator accounts (per NVD).