Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 1.0%
exploitation probability
1.0%top 40% of all CVEs
observed exploitation
nono source reports it
The device has two web servers that expose unauthenticated REST APIs on the management network (TCP
ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary
commands that are executed with administrative permissions by the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Radiflow · iSAP Smart Collector