Paper/Archive/CVE-2025-26339

CVE-2025-26339

Q-Free MaxTime — A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 66.0.660 × 2013.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.

Affected

ProductAffectedFixed inSource

MaxTime≤ 2.11.0–CNA

Scores by source

Nozomi (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refnozominetworks.com/labs/vulnerability-advisories-cve-2025-26339