CVE-2025-26339

9.8 criticalEPSS 1.1%

Critical (9.8) in q-free maxtime. EPSS 1.1% chance of exploitation in the next 30 days.

A CWE-306 "Missing Authentication for Critical Function" in maxtime/handleRoute.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability in multiple unspecified ways via crafted HTTP requests.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-02-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

q-free:maxtime

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26339

Check your stack JSON