CVE-2025-27027: Restricted shell evasion in Radiflow iSAP Smart Collector

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-09 · updated 2026-06-17
Weakness: CWE-653

Description

A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.

Affected products

Radiflow iSAP Smart Collector: from 1.20 before 3.02-1 — fixed in 3.02-1

How to fix

Upgrade to a fixed version: Radiflow iSAP Smart Collector 3.02-1. Check the vendor advisory for mitigations.

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-27027

Get alerted when CVE-2025-27027 or the next vulnerability affects your stack