CVE-2025-26347
Published: 12 February 2025
Summary
CVE-2025-26347 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 28.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly identifies and restricts critical functions like user permission editing that can be performed without identification or authentication, addressing the core missing authentication flaw.
Enforces approved authorizations for access to system resources such as user permissions, requiring authentication checks on the vulnerable endpoint.
Employs least privilege to ensure only authorized users can edit permissions, mitigating the impact of any bypasses or misconfigurations in authentication.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote editing of user permissions (T1098: Account Manipulation) via a public-facing web application (T1190: Exploit Public-Facing Application).
NVD Description
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26347 is a CWE-306 "Missing Authentication for Critical Function" vulnerability in the maxprofile/menu/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. This flaw enables an unauthenticated remote attacker to edit user permissions through crafted HTTP requests, as the affected endpoint lacks proper authentication checks. The vulnerability received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its critical severity due to high impacts on confidentiality, integrity, and availability.
Any unauthenticated attacker with network access to the vulnerable Q-Free MaxTime instance can exploit this issue by sending specially crafted HTTP requests to the maxprofile/menu/routes.lua endpoint. Successful exploitation allows arbitrary modification of user permissions, potentially enabling privilege escalation, unauthorized access to sensitive functions, or full administrative control over the system, depending on the target's configuration.
Mitigation details and additional technical information are available in the advisory published by Nozomi Networks Labs at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26347. The vulnerability was publicly disclosed on 2025-02-12.
Details
- CWE(s)