CVE-2025-26344
Published: 12 February 2025
Summary
CVE-2025-26344 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 23.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-14 directly restricts and documents permitted actions without identification or authentication, preventing unauthenticated attackers from enabling passwordless guest mode via crafted HTTP requests.
AC-3 enforces approved authorizations for access to system resources, ensuring critical functions like the guest-mode endpoint require authentication.
IA-9 mandates identification and authentication for system services as a prerequisite to access, blocking unauthenticated exploitation of the vulnerable routes.lua endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability (CWE-306 Missing Authentication for Critical Function) in the Q-Free MaxTime web application allows unauthenticated remote attackers to enable passwordless guest mode via crafted HTTP requests, enabling exploitation of a public-facing application for unauthorized access.
NVD Description
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/guest-mode/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable passwordless guest mode via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26344 is a CWE-306 "Missing Authentication for Critical Function" vulnerability in the maxprofile/guest-mode/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. Published on 2025-02-12, it enables an unauthenticated remote attacker to activate passwordless guest mode through crafted HTTP requests. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low complexity, and high potential impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network access to the affected Q-Free MaxTime instance can exploit this vulnerability without privileges or user interaction by sending specially crafted HTTP requests to the vulnerable routes.lua endpoint. Exploitation results in enabling passwordless guest mode, which could allow unauthorized access to system functions and resources, aligning with the high CVSS impact ratings.
Mitigation details are available in the advisory from Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26344.
Details
- CWE(s)