CVE-2026-22312

Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector

Published Jun 16, 2026 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration
and execute some commands (e.g. system reboot).

Analysis

Technical impact

The webserver of the Radiflow iSAP Smart Collector uses a constant token for authentication, allowing any user to access an unauthenticated REST API. An attacker can retrieve system settings, change configuration, and run privileged commands such as rebooting the device. This flaw is a hard‑coded credential weakness (CWE-798) that can lead to unauthorized administrative control of the device.

Affected Systems

Radiflow iSAP Smart Collector. No specific version information is available; all released versions that ship the default hard‑coded token are affected.

Risk and Exploitability

The CVSS score of 8.6 marks the vulnerability as high severity. The EPSS score, below 1%, suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector relies on network access to the web server’s REST API, so systems exposed to external networks are at risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Radiflow

iSAP Smart Collector

unaffected

Version	Status	Constraints
`3.07-1`	affected	—

No data.

Vendor Product Versions

Radiflow

Isap Smart Collector

Version	Status	Scheme	Platform
`3.07-1`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the device to the latest firmware that removes the hard‑coded token or implements proper authentication.
If an upgrade is not immediately possible, replace the default constant token with a strong, unique credential that is not publicly documented.
Limit network exposure of the web API by configuring firewall rules or access control lists so only trusted IP ranges can reach it.
Continuously monitor API logs for suspicious activity and enforce audit trails.

Generated by OpenCVE AI on June 17, 2026 at 21:18 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.232% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22312

History

Jun 17, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Radiflow Radiflow isap Smart Collector
Vendors & Products		Radiflow Radiflow isap Smart Collector

Jun 16, 2026 7:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Title		Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
Weaknesses		CWE-798
References		https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22312
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}`