Cyber Resilience

CVE-2025-26341

Critical

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0099 77.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26341 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 22.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

The vulnerability CVE-2025-26341 is a missing authentication for a critical function (CWE-306) in the file maxprofile/accounts/routes.lua of Q-Free MaxTime versions 2.11.0 and earlier. The flaw resides in password management functionality and allows remote manipulation of user accounts via HTTP without any credentials or session validation. It received a CVSS 3.1 base score of 9.8.

An unauthenticated attacker with network access can send crafted HTTP requests to reset arbitrary user passwords. Successful exploitation grants the ability to take over any account, resulting in loss of confidentiality, integrity, and availability of the affected system.

The associated advisory from Nozomi Networks provides additional technical context on the issue. The EPSS score remains low, with a current value of 0.0099 and a recorded peak of 0.0162.

EU & UK References

Vulnerability details

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset arbitrary user passwords via crafted HTTP requests.

CWE(s)
CWE-306

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated password reset vulnerability in a exposed management web app enables exploitation of public-facing application (T1190), direct account manipulation via password changes (T1098), and obtaining valid accounts for further access (T1078).

CVEs Like This One

CVE-2025-26359Same product: Q-Free Maxtime
CVE-2025-26347Same product: Q-Free Maxtime
CVE-2025-26345Same product: Q-Free Maxtime
CVE-2025-26362Same product: Q-Free Maxtime
CVE-2025-26363Same product: Q-Free Maxtime
CVE-2025-26344Same product: Q-Free Maxtime
CVE-2025-26366Same product: Q-Free Maxtime
CVE-2025-26365Same product: Q-Free Maxtime
CVE-2025-26339Same product: Q-Free Maxtime
CVE-2025-26364Same product: Q-Free Maxtime

Affected Assets

q-free
maxtime
≤ 2.11.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Directly requires identification and limitation of critical functions, such as password resets, that permit actions without authentication, preventing unauthenticated exploitation.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for access to system resources, ensuring authentication is required for sensitive operations like arbitrary password resets.

AC-2 Account Management partial match
prevent

Manages user accounts and access authorizations, including procedures to protect against unauthorized password modifications or resets.

References