Description
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration
and execute some commands (e.g. system reboot).
Published: 2026-06-16
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The webserver of the Radiflow iSAP Smart Collector uses a constant token for authentication, allowing any user to access an unauthenticated REST API. An attacker can retrieve system settings, change configuration, and run privileged commands such as rebooting the device. This flaw is a hard‑coded credential weakness (CWE-798) that can lead to unauthorized administrative control of the device.

Affected Systems

Radiflow iSAP Smart Collector. No specific version information is available; all released versions that ship the default hard‑coded token are affected.

Risk and Exploitability

The CVSS score of 8.6 marks the vulnerability as high severity. The EPSS score, below 1%, suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector relies on network access to the web server’s REST API, so systems exposed to external networks are at risk.

Generated by OpenCVE AI on June 17, 2026 at 21:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device to the latest firmware that removes the hard‑coded token or implements proper authentication.
  • If an upgrade is not immediately possible, replace the default constant token with a strong, unique credential that is not publicly documented.
  • Limit network exposure of the web API by configuring firewall rules or access control lists so only trusted IP ranges can reach it.
  • Continuously monitor API logs for suspicious activity and enforce audit trails.

Generated by OpenCVE AI on June 17, 2026 at 21:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 17 Jun 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Radiflow
Radiflow isap Smart Collector
Vendors & Products Radiflow
Radiflow isap Smart Collector

Tue, 16 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Description The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Title Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
Weaknesses CWE-798
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

Subscriptions

Radiflow Isap Smart Collector
cve-icon MITRE

Status: PUBLISHED

Assigner: ENISA

Published:

Updated: 2026-06-17T12:18:41.856Z

Reserved: 2026-01-07T09:31:00.563Z

Link: CVE-2026-22312

cve-icon Vulnrichment

Updated: 2026-06-17T12:18:38.554Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-06-16T20:16:28.590

Modified: 2026-06-16T20:47:43.440

Link: CVE-2026-22312

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-17T21:30:12Z

Weaknesses
  • CWE-798

    Use of Hard-coded Credentials