What’s Vulnerable › Vulnerabilities

CVE-2026-22312: Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-16 · updated 2026-10-25
• Weakness: CWE-798

Description

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).

Affected products

• Radiflow iSAP Smart Collector: 3.07-1

References

• https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22312

Get alerted when CVE-2026-22312 or the next vulnerability affects your stack