PT-2025-28864 · Radiflow · Radiflow Isap Smart Collector

Published 2025-07-09 · Updated 2025-07-14 · CVE-2025-3498

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions: Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20)

Description: An unauthenticated user with management network access can access and modify the configuration of the Radiflow iSAP Smart Collector. The device has two web servers that expose unauthenticated REST APIs on the management network, specifically on TCP ports 8084 and 8086. An attacker can use these APIs to access all system settings, modify the configuration, and execute certain commands, such as a system reboot.

Recommendations: For Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20), consider disabling access to the unauthenticated REST APIs on TCP ports 8084 and 8086 until a patch is available. Restrict access to the management network to minimize the risk of exploitation. Avoid using the affected APIs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-13114

CVE-2025-3498

Affected Products

Radiflow Isap Smart Collector

References · 9

• https://cve.org/CVERecord?id=CVE-2025-3498 · Security Note
• https://bdu.fstec.ru/vul/2025-13114 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-3498 · Security Note
• https://twitter.com/VulmonFeeds/status/1942900876055597399 · Twitter Post
• https://twitter.com/cracbot/status/1944713547998748920 · Twitter Post
• https://t.me/cvenotify/128157 · Telegram Post
• https://cvcn.gov.it/cvcn/cve/CVE-2025-3498 · Note
• https://twitter.com/CveFindCom/status/1942874106765934723 · Twitter Post
• https://twitter.com/CVEnew/status/1942924457196302785 · Twitter Post