Vulnerability · Published Jun 16, 2026 · Assigned by ENISA
CVE-2026-22312Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
High 8.6
In plain English
A high-severity hard-coded credentials in iSAP Smart Collector from Radiflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Radiflow | iSAP Smart Collector | 3.07-1 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
References
- https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22312 third-party-advisory