CVE-2025-26362
Published: 12 February 2025
Summary
CVE-2025-26362 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-26362 is a missing authentication vulnerability (CWE-306) affecting the maxprofile/setup/routes.lua component in Q-Free MaxTime versions up to and including 2.11.0. The flaw permits unauthenticated remote attackers to configure an arbitrary authentication profile server by sending specially crafted HTTP requests, resulting in a CVSS 3.1 score of 7.5 with network attack vector, low complexity, and high integrity impact.
An unauthenticated attacker with network access can exploit the issue without credentials or user interaction to alter the authentication profile server, potentially redirecting authentication traffic or undermining trust in the system's profile handling.
The EPSS score has risen from a low baseline to a recorded peak of 0.0135, indicating emerging exploitation interest after disclosure. A detailed advisory is available from Nozomi Networks at the referenced URL.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4174
Vulnerability details
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in the web management interface (maxprofile/setup/routes.lua) allows unauthenticated remote attackers to modify the authentication profile server via crafted HTTP requests, enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 directly addresses CWE-306 by requiring explicit identification and limitation of critical functions like setup routes that permit actions without authentication.
IA-8 mandates identification and authentication for non-organizational users, preventing unauthenticated remote attackers from setting arbitrary authentication profile servers.
AC-3 enforces approved access authorizations, ensuring crafted HTTP requests to critical setup endpoints require proper authentication.