Cyber Resilience

CVE-2025-26359

Critical

Published: 12 February 2025

Published
12 February 2025
Modified
28 October 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0129 80.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26359 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 19.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2025-26359 is a missing authentication for critical function vulnerability (CWE-306) located in maxprofile/accounts/routes.lua within Q-Free MaxTime versions 2.11.0 and earlier. The flaw enables direct access to PIN reset functionality without any authentication checks and is rated 9.8 on CVSS v3.1.

An unauthenticated remote attacker can send crafted HTTP requests to reset arbitrary user PINs, resulting in high impact to confidentiality, integrity, and availability.

The current EPSS score stands at 0.0129 with a recorded peak of 0.0220, and further details are provided in the Nozomi Networks advisory.

EU & UK References

Vulnerability details

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.

CWE(s)
CWE-306

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authentication for PIN reset function in public-facing web application enables unauthenticated remote exploitation (T1190) and account manipulation via credential reset (T1098).

CVEs Like This One

CVE-2025-26347Same product: Q-Free Maxtime
CVE-2025-26341Same product: Q-Free Maxtime
CVE-2025-26362Same product: Q-Free Maxtime
CVE-2025-26345Same product: Q-Free Maxtime
CVE-2025-26363Same product: Q-Free Maxtime
CVE-2025-26344Same product: Q-Free Maxtime
CVE-2025-26366Same product: Q-Free Maxtime
CVE-2025-26365Same product: Q-Free Maxtime
CVE-2025-26339Same product: Q-Free Maxtime
CVE-2025-26364Same product: Q-Free Maxtime

Affected Assets

q-free
maxtime
≤ 2.11.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Directly identifies and restricts critical functions like unauthenticated PIN resets to only explicitly documented non-sensitive actions.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations for access to system resources, preventing unauthenticated crafted requests to the PIN reset endpoint.

AC-2 Account Management partial match
prevent

Requires secure account management including notifications of changes and disabling compromised accounts, mitigating impacts of unauthorized PIN resets.

References