Cyber Posture

CVE-2025-26345

Critical

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0075 73.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26345 is a CWE-306 "Missing Authentication for Critical Function" vulnerability affecting the maxprofile/menu/routes.lua component in Q-Free MaxTime versions less than or equal to 2.11.0. This flaw enables an unauthenticated remote attacker to edit user group permissions through crafted HTTP requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and potential for high confidentiality, integrity, and availability impacts.

An unauthenticated attacker with network access to the affected Q-Free MaxTime instance can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable endpoint. Successful exploitation allows modification of user group permissions, potentially granting elevated privileges, enabling further compromise of the system, data exfiltration, or disruption of services without requiring prior authentication or user interaction.

Nozomi Networks has published a vulnerability advisory detailing CVE-2025-26345 at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26345, which security practitioners should consult for mitigation guidance and patch information.

Details

CWE(s)
CWE-306

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1098.007 Additional Local or Domain Groups Persistence
An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unauthenticated remote access to edit user group permissions via public-facing web app enables exploitation for privilege escalation (T1068, T1190) and direct account/group manipulation (T1098, T1098.007).

References