CVE-2025-26359
Published: 12 February 2025
Summary
CVE-2025-26359 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked in the top 20.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly identifies and restricts critical functions like unauthenticated PIN resets to only explicitly documented non-sensitive actions.
Enforces approved authorizations for access to system resources, preventing unauthenticated crafted requests to the PIN reset endpoint.
Requires secure account management including notifications of changes and disabling compromised accounts, mitigating impacts of unauthorized PIN resets.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication for PIN reset function in public-facing web application enables unauthenticated remote exploitation (T1190) and account manipulation via credential reset (T1098).
NVD Description
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/accounts/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to reset user PINs via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26359, published on 2025-02-12, is a critical vulnerability with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It manifests as a CWE-306 Missing Authentication for Critical Function in the maxprofile/accounts/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. This flaw allows an unauthenticated remote attacker to reset user PINs by sending crafted HTTP requests to the affected endpoint.
The vulnerability can be exploited by any unauthenticated attacker with network access to the Q-Free MaxTime instance, requiring low attack complexity and no privileges, user interaction, or special conditions. Exploitation enables the attacker to arbitrarily reset user PINs, which can facilitate account takeovers, unauthorized access to protected functions, and broader system compromise, resulting in high impacts across confidentiality, integrity, and availability.
For mitigation details, refer to the vulnerability advisory from Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26359.
Details
- CWE(s)