Cyber Posture

CVE-2025-26370

High

Published: 12 February 2025

Published
12 February 2025
Modified
28 October 2025
KEV Added
—
Patch
—
CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
EPSS Score 0.0016 35.9th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

Security Summary

CVE-2025-26370 is a CWE-862 Missing Authorization vulnerability in the maxprofile/user-groups/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. It enables an authenticated low-privileged attacker to remove privileges from user groups through crafted HTTP requests. The vulnerability carries a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, indicating network accessibility, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

An authenticated attacker with low privileges can exploit this vulnerability remotely by sending specially crafted HTTP requests to the affected endpoint. Successful exploitation allows the attacker to strip privileges from user groups, potentially escalating control over the system by demoting other users or groups, disrupting access controls, and enabling further unauthorized actions within the MaxTime environment.

For mitigation details, refer to the advisory published by Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26370.

Details

CWE(s)
CWE-862

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1531 Account Access Removal Impact
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
attack.mitre.org →
Why these techniques?

Missing authorization allows low-privileged authenticated attackers to remove privileges from user groups via crafted HTTP requests to the exposed web management interface, enabling exploitation for privilege escalation (T1068, T1210), account manipulation (T1098), and account access removal (T1531).

References