CVE-2025-26339

Summary

CVE-2025-26339 is a vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. This issue, classified as CWE-306 "Missing Authentication for Critical Function," allows unauthenticated attackers to manipulate device confidentiality, integrity, or availability through crafted HTTP requests. Specifically, in the maxtime/handleRoute.lua file, a critical function lacks required authentication, enabling attackers to exploit this gap and impact the device in multiple unspecified ways.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.