CVE-2025-26362

7.5HIGH

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbit

Publicado: 2/12/2025Actualizado: 10/28/2025
Ver en NVDVer en MITRE

Descripción

A CWE-306 "Missing Authentication for Critical Function" in maxprofile/setup/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to set an arbitrary authentication profile server via crafted HTTP requests.

Análisis IAImpulsado por IA

Productos Afectados

q-freemaxtime

Referencias