Cyber Posture

CVE-2025-26346

Medium

Published: 12 February 2025

Published
12 February 2025
Modified
24 October 2025
KEV Added
Patch
CVSS Score 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.0018 39.7th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Security Summary

CVE-2025-26346 is a SQL injection vulnerability classified under CWE-89, stemming from improper neutralization of special elements used in an SQL command. It affects Q-Free MaxTime in versions less than or equal to 2.11.0, specifically within the maxprofile/menu/model.lua component at the editUserGroupMenu endpoint. Published on 2025-02-12, the flaw enables an authenticated remote attacker to execute arbitrary SQL commands through crafted HTTP requests.

The vulnerability requires high privileges (PR:H) for exploitation over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). A successful attack can compromise data integrity (I:H) and cause limited availability impact (A:L), but does not affect confidentiality (C:N) or change the scope (S:U). The CVSS v3.1 base score reflects a moderate severity of 5.5.

Mitigation guidance is available in the Nozomi Networks vulnerability advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26346.

Details

CWE(s)
CWE-89

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Why these techniques?

SQL injection enables arbitrary SQL execution for database data collection/exfiltration (T1213.006), stored data modification/manipulation (T1565.001), and data destruction/deletion (T1485).

References