NEW: Watch the N20S v25.2 Release Notes
Watch
CVE-2025-26363
A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enable an authentication profile server via crafted HTTP requests.
An unauthenticated remote attacker may enable an authentication profile server, potentially bypassing authentication.
February 11, 2025
This issue affects: Q-Free MaxTime less than or equal to version 2.11.0.
CVE-2025-26363
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
7.5
An official solution has not been communicated by the vendor. The vulnerability can be exploited by unauthenticated remote attackers. As a temporary solution, until a patch is released, it is highly recommended to restrict and monitor the network access to the management web application exposed by devices running Q-Free MaxTime less than or equal to version 2.11.0.
Diego Giubertoni of Nozomi Networks
Nozomi Networks Labs curates threat and vulnerability insights that are continuously fed into the Nozomi Networks platform to ensure our sensors can detect existing and emerging threats and vulnerabilities that threaten customers environments.
Learn more
