CVE-2025-26365
Published: 12 February 2025
Summary
CVE-2025-26365 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Q-Free Maxtime. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-26365 is a missing authentication for critical function vulnerability (CWE-306) located in maxprofile/setup/routes.lua within Q-Free MaxTime versions 2.11.0 and earlier. The flaw resides in an exposed HTTP endpoint that should be protected, allowing direct interaction with a privileged configuration action.
An unauthenticated remote attacker can send crafted HTTP requests to enable front panel authentication. The attack requires no credentials or user interaction and yields a high integrity impact while leaving confidentiality and availability unaffected, consistent with the CVSS 3.1 score of 7.5.
The associated EPSS score has climbed from a low baseline to a recorded peak of 0.0135, indicating that exploitation interest emerged after public disclosure. A single advisory reference is available at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26365.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4177
Vulnerability details
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable front panel authentication via crafted HTTP requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a missing authentication for a critical function in the public-facing web management interface (maxprofile/setup/routes.lua), enabling unauthenticated remote attackers to send crafted HTTP requests to enable front panel authentication and potentially lock out legitimate users, directly facilitating T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-14 explicitly identifies and precludes critical actions without identification or authentication, directly addressing the missing authentication for the front panel enablement function in routes.lua.
AC-3 enforces approved authorizations for access to system resources, preventing unauthenticated remote attackers from executing critical functions via crafted HTTP requests.
AC-6 applies least privilege to restrict the vulnerable endpoint to only authorized accesses necessary for tasks, mitigating unauthorized enabling of front panel authentication.