Vulnerability · Published Jul 9, 2025 · Assigned by ENISA
CVE-2025-3499Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector
Critical 10.0
In plain English
A critical-severity OS command injection in iSAP Smart Collector from Radiflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)1.0%top 37.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Radiflow | iSAP Smart Collector | 1.20 – before 3.02-1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499 government-resource