PT-2026-49826 · Radiflow · Isap Smart Collector

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-22312

NVD

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-22312

Affected Products

Isap Smart Collector

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-22312 · Security Note
• https://cvcn.gov.it/cvcn/cve/CVE-2026-22312 · Note