Cyber Posture

CVE-2025-26342

Critical

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0099 77.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26342 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 23.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-2 (Account Management).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

AC-14 directly mandates identification and restriction of critical functions like user creation that are permitted without authentication, preventing unauthenticated arbitrary account creation.

prevent

AC-3 enforces access control policies to block unauthenticated remote attackers from accessing the vulnerable user creation endpoint in maxprofile/accounts/routes.lua.

prevent

AC-2 governs account management processes to ensure only authorized entities can create users, including administrators, mitigating exploitation of the missing authentication.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authentication in web application allows unauthenticated remote creation of arbitrary local administrator accounts, enabling T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), and T1136.001 (Create Account: Local Account).

NVD Description

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to create arbitrary users, including administrators, via crafted HTTP requests.

Deeper analysisAI

CVE-2025-26342, published on 2025-02-12, is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) classified as CWE-306, Missing Authentication for Critical Function. It affects the maxprofile/accounts/routes.lua component in Q-Free MaxTime versions less than or equal to 2.11.0. The issue enables unauthenticated remote attackers to create arbitrary users, including administrators, by sending crafted HTTP requests.

An unauthenticated remote attacker with network access can exploit this vulnerability without requiring privileges, user interaction, or special conditions due to its low attack complexity. Exploitation allows the creation of unauthorized accounts with elevated privileges, such as administrator roles, potentially compromising the entire system through unauthorized access, data manipulation, and disruption.

For details on mitigation, including any patches or workarounds, refer to the advisory from Nozomi Networks Labs at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26342.

Details

CWE(s)

Affected Products

q-free
maxtime
≤ 2.11.0

CVEs Like This One

CVE-2025-26345Same product: Q-Free Maxtime
CVE-2025-26366Same product: Q-Free Maxtime
CVE-2025-26344Same product: Q-Free Maxtime
CVE-2025-26362Same product: Q-Free Maxtime
CVE-2025-26365Same product: Q-Free Maxtime
CVE-2025-26363Same product: Q-Free Maxtime
CVE-2025-26359Same product: Q-Free Maxtime
CVE-2025-26339Same product: Q-Free Maxtime
CVE-2025-26347Same product: Q-Free Maxtime
CVE-2025-26341Same product: Q-Free Maxtime

References