CVE-2025-26359

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Feb 12, 2025
CWE ID 306

Summary

CVE-2025-26359 is a critical vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. The issue, categorized as CWE-306 "Missing Authentication for Critical Function," allows unauthenticated attackers to manipulate user PINs by exploiting a missing authentication check in maxprofile/accounts/routes.lua. This vulnerability could lead to serious security consequences, making it crucial for users to upgrade to the latest version of Q-Free MaxTime to mitigate this risk.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Q-Free Maxtime

Affected Vendors

  • Nozomi Networks

Advisories, Assessments, and Mitigations