CVE-2025-1100
Published: 12 February 2025
Summary
CVE-2025-1100 is a critical-severity Use of Hard-coded Password (CWE-259) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked in the top 16.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
IA-5 requires the management of authenticators including prohibitions on hard-coded passwords, directly preventing exploitation of the root account credential in this CVE.
SI-2 mandates identification, reporting, and correction of system flaws like this hard-coded password vulnerability through patching or equivalent remediation.
AC-2 provides for account management practices that disable unnecessary privileged accounts or remove default credentials, mitigating remote root access via SSH.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hard-coded root password enables default account abuse (T1078.001) for unauthenticated remote access via exposed SSH service (T1133, T1190), resulting in root-level arbitrary code execution.
NVD Description
A CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH.
Deeper analysisAI
CVE-2025-1100, published on 2025-02-12, is a critical vulnerability with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting Q-Free MaxTime versions less than or equal to 2.11.0. The issue is classified as CWE-259, involving the use of a hard-coded password for the root account. This flaw allows an unauthenticated remote attacker to execute arbitrary code with root privileges via SSH.
Any unauthenticated attacker with network access to the affected system can exploit this vulnerability by authenticating over SSH using the hard-coded root password. Successful exploitation grants full root-level access, enabling arbitrary code execution that can result in complete compromise of the system, including high impacts to confidentiality, integrity, and availability.
Mitigation details are available in the advisory from Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-1100.
Details
- CWE(s)