Cyber Posture

CVE-2025-26342

Critical

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0099 77.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26342, published on 2025-02-12, is a critical vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) classified as CWE-306, Missing Authentication for Critical Function. It affects the maxprofile/accounts/routes.lua component in Q-Free MaxTime versions less than or equal to 2.11.0. The issue enables unauthenticated remote attackers to create arbitrary users, including administrators, by sending crafted HTTP requests.

An unauthenticated remote attacker with network access can exploit this vulnerability without requiring privileges, user interaction, or special conditions due to its low attack complexity. Exploitation allows the creation of unauthorized accounts with elevated privileges, such as administrator roles, potentially compromising the entire system through unauthorized access, data manipulation, and disruption.

For details on mitigation, including any patches or workarounds, refer to the advisory from Nozomi Networks Labs at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26342.

Details

CWE(s)
CWE-306

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authentication in web application allows unauthenticated remote creation of arbitrary local administrator accounts, enabling T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), and T1136.001 (Create Account: Local Account).

References