CVE-2025-26347
Published: 12 February 2025
Summary
CVE-2025-26347 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 28.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-26347 is a missing authentication vulnerability (CWE-306) affecting the file maxprofile/menu/routes.lua in Q-Free MaxTime versions up to and including 2.11.0. The flaw resides in a critical function that handles user permission management and can be reached over the network without any credentials.
An unauthenticated remote attacker can send crafted HTTP requests to modify user permissions. With a CVSS score of 9.8, successful exploitation grants complete control over confidentiality, integrity, and availability of the affected system.
The sole reference advisory from Nozomi Networks describes the issue and is available at the listed URL; no vendor patch or explicit mitigation steps are provided in the supplied data. The EPSS score rose from a low baseline to a peak of 0.0123, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4159
Vulnerability details
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/menu/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to edit user permissions via crafted HTTP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote editing of user permissions (T1098: Account Manipulation) via a public-facing web application (T1190: Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and restricts critical functions like user permission editing that can be performed without identification or authentication, addressing the core missing authentication flaw.
Enforces approved authorizations for access to system resources such as user permissions, requiring authentication checks on the vulnerable endpoint.
Employs least privilege to ensure only authorized users can edit permissions, mitigating the impact of any bypasses or misconfigurations in authentication.