PT-2025-28865 · Radiflow · Isap Smart Collector

Published 2025-07-09 · Updated 2025-07-14 · CVE-2025-3499

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined.

Description: The device has two web servers that expose unauthenticated REST APIs on the management network, specifically on TCP ports 8084 and 8086. An attacker can exploit OS command injection through these APIs to send arbitrary commands that are executed with administrative permissions by the underlying operating system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-13115

CVE-2025-3499

Affected Products

Isap Smart Collector

References · 8

• https://bdu.fstec.ru/vul/2025-13115 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-3499 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-3499 · Security Note
• https://twitter.com/CVEnew/status/1942924456181236040 · Twitter Post
• https://twitter.com/cracbot/status/1944713549932359761 · Twitter Post
• https://twitter.com/CveFindCom/status/1942874051564748950 · Twitter Post
• https://cvcn.gov.it/cvcn/cve/CVE-2025-3499 · Note
• https://t.me/cvenotify/128158 · Telegram Post