CVE-2025-26344

The vulnerability is located in the maxprofile/guest-mode/routes.lua file and results from the lack of an authentication mechanism for the critical guest mode management function. The attacker sends specially crafted HTTP requests to the vulnerable endpoint, bypassing all access controls. As a result, it is possible to activate guest mode without a password without possessing any privileges in the system.

An unauthenticated remote attacker can take control of the system's guest mode function, leading to unauthorized access to resources protected by this mechanism, and potentially resulting in a breach of confidentiality, integrity, and availability of the system (CVSS score indicates complete compromise of all three areas).

Apply patches available from the manufacturer according to the references. It is recommended to update to a version higher than 2.11.0 and restrict network access to the Q-Free MaxTime system management interface exclusively to trusted hosts.

Q-Free MaxTime version 2.11.0 and all earlier versions