Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-22313

OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Radiflow
Products
Isap Smart Collector
CVE-2026-22312

Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Radiflow
Products
Isap Smart Collector
CVE-2025-3499

Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector

The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Radiflow
Products
Isap Smart Collector