CVE-2025-26362
Published: 12 February 2025
Summary
CVE-2025-26362 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-14 directly addresses CWE-306 by requiring explicit identification and limitation of critical functions like setup routes that permit actions without authentication.
IA-8 mandates identification and authentication for non-organizational users, preventing unauthenticated remote attackers from setting arbitrary authentication profile servers.
AC-3 enforces approved access authorizations, ensuring crafted HTTP requests to critical setup endpoints require proper authentication.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in the web management interface (maxprofile/setup/routes.lua) allows unauthenticated remote attackers to modify the authentication profile server via crafted HTTP requests, enabling exploitation of a public-facing application.
NVD Description
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26362 is a CWE-306 Missing Authentication for Critical Function vulnerability in the maxprofile/setup/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. Published on 2025-02-12, it enables an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), highlighting its network accessibility, low complexity, and high integrity impact without affecting confidentiality or availability.
Any unauthenticated attacker with network access to the vulnerable Q-Free MaxTime instance can exploit this flaw by sending crafted HTTP requests to the affected setup routes. Successful exploitation allows the attacker to redirect the authentication profile server to an arbitrary endpoint under their control, potentially enabling manipulation of authentication flows and compromising the integrity of user verification processes.
Mitigation guidance is available in the Nozomi Networks vulnerability advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26362.
Details
- CWE(s)