Cyber Posture

CVE-2025-26378

High

Published: 12 February 2025

Published
12 February 2025
Modified
10 April 2025
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0015 35.9th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26378 is a CWE-862 missing authorization vulnerability in the maxprofile/users/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. Published on 2025-02-12T14:15:39.163, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue enables an authenticated low-privileged attacker to reset passwords, including those of administrator accounts, by sending crafted HTTP requests.

A low-privileged authenticated user can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation allows the attacker to reset passwords for any user account, including administrators, resulting in high impacts to confidentiality, integrity, and availability, such as potential full system compromise through privilege escalation.

Mitigation guidance is provided in the Nozomi Networks Labs vulnerability advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26378.

Details

CWE(s)
CWE-862

Affected Products

q-free
maxtime
≤ 2.11.0

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Missing authorization in web management interface enables low-privileged authenticated attackers to reset admin passwords via crafted requests, facilitating exploitation of public-facing application (T1190), exploitation for privilege escalation (T1068), and account manipulation (T1098).

References