CVE-2025-26364
Published: 12 February 2025
Summary
CVE-2025-26364 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
The vulnerability is a CWE-306 Missing Authentication for Critical Function present in the maxprofile/setup/routes.lua component of Q-Free MaxTime versions up to and including 2.11.0. It carries a CVSS 3.1 score of 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
An unauthenticated remote attacker can exploit the issue over the network by submitting crafted HTTP requests, achieving the ability to disable an authentication profile server and thereby producing a high integrity impact without requiring user interaction or credentials.
The associated advisory published by Nozomi Networks Labs at the reference URL supplies additional technical context for the flaw. The EPSS score shows a material rise from a low starting value of 0.0057 to a peak of 0.0135, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4176
Vulnerability details
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to disable an authentication profile server via crafted HTTP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability (CWE-306) in a public-facing management web application allows unauthenticated remote attackers to disable an authentication profile server via crafted HTTP requests, enabling exploitation of public-facing applications (T1190), service stop (T1489), and impairing defenses by disabling security tools (T1562.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires organizations to identify, authorize, and limit critical functions like disabling authentication servers that can be performed without identification or authentication, preventing exploitation of the unauthenticated endpoint.
Mandates enforcement of access control policies by systems, ensuring authentication is required before allowing critical operations such as disabling the authentication profile server via HTTP requests.
Requires timely identification, reporting, and remediation of flaws, directly addressing the missing authentication in the maxprofile/setup/routes.lua component to prevent remote exploitation.