CVE-2025-26378 is a missing-authorization flaw (CWE-862) in Q-Free MaxTime, traffic signal controller software from the Norwegian ITS vendor Q-Free: a low-privileged authenticated attacker can reset the password of any user account on the device, including administrator accounts, via crafted HTTP requests to the maxprofile/users/routes.lua component on version 2.11.0 and earlier, giving the attacker full administrative control. NVD and the discovering researcher agree on a CVSS v3.1 score of 8.8 (high).
Vulnerability summary
8.8
High
0.6%
EPSS score (FIRST)
No
CISA KEV catalog
2025-02-12
Published
Vulnerability ID: CVE-2025-26378 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Q-Free MaxTime traffic signal controller software | cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:* | Q-Free MaxTime version 2.11.0 and earlier, per Nozomi Networks Labs CVE-2025-26378 advisory |
What does this mean for affected devices?
CVE-2025-26378 (CWE-862, missing authorization) affects Q-Free MaxTime, the traffic signal controller software made by Q-Free AS, "a Norwegian technology company... specializing in intelligent transportation systems (ITS)" that develops "traffic signal control" products including MAXTIME (Wikipedia — Q-Free).
NVD's description states: "A CWE-862 'Missing Authorization' in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests" (NVD).
NVD records a Primary CVSS v3.1 score of 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Nozomi Networks, which discovered and reported the issue, records an identical Secondary score and vector — unlike several of the other CVEs in the same MaxTime advisory batch, where Nozomi's own rating diverges from NVD's (NVD).
Nozomi Networks' advisory, issued February 11, 2025, describes the impact as full administrative takeover and states that "no official patch has been released," recommending operators regularly review user passwords — especially administrator accounts — and remove unnecessary user accounts from the management web application as interim mitigations (Nozomi Networks Labs — CVE-2025-26378).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0057 (47.7th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Agencies operating Q-Free MaxTime traffic signal controllers at or below version 2.11.0 should restrict network access to the management web application, audit and remove unnecessary user accounts, and rotate administrator credentials until the vendor publishes a fix.
Evidence
- A CWE-862 missing authorization in maxprofile/users/routes.lua in Q-Free MaxTime version 2.11.0 and earlier allows an authenticated low-privileged attacker to reset passwords, including administrator accounts, via crafted HTTP requests. — NVD
- NVD Primary CVSS v3.1 score 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; Nozomi Networks recorded an identical Secondary score and vector. — NVD
- No official patch has been released; interim mitigations are reviewing user passwords (especially administrator accounts) and removing unnecessary user accounts from the management web application. — Nozomi Networks Labs — CVE-2025-26378
- Q-Free AS is a Norwegian ITS vendor that develops hardware and software for traffic management and traffic signal control, and lists MAXTIME among its products. — Wikipedia — Q-Free
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0057 (47.7th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can a low-privileged attacker actually do by exploiting CVE-2025-26378?
By sending crafted HTTP requests to the maxprofile/users/routes.lua component, an authenticated attacker who holds only low privileges can reset the password of any user account on the controller, including administrator accounts, effectively taking full administrative control (per NVD).
Is a vendor patch available for CVE-2025-26378?
No. Nozomi Networks' advisory, issued February 11, 2025, states 'no official patch has been released,' and recommends regularly reviewing user passwords — especially administrator accounts — and removing unnecessary user accounts from the management web application as interim mitigations (per Nozomi Networks Labs — CVE-2025-26378).
Do NVD and the discovering researcher agree on how severe this is?
Yes — unlike several of the other CVEs in the same MaxTime disclosure batch, NVD's Primary CVSS v3.1 score (8.8, high) and Nozomi Networks' own Secondary score use an identical vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (per NVD; per Nozomi Networks Labs — CVE-2025-26378).
Is this related to any other Q-Free MaxTime vulnerability?
Yes, the sibling advisory CVE-2025-26350, disclosed the same day and affecting the same version range (2.11.0 and earlier), is a separate unrestricted file upload flaw in MaxTime's template upload feature (per NVD).