Vulnerabilidades de Radiflow
CVEs publicadas que afetam produtos de Radiflow: 2 registro(s), com severidade, exploração e correções.
CVE-2026-22313
Crítica · 9.1
CWE-78 16/06/2026
OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send
arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
CVE-2026-22312
Alta · 8.6
CWE-798 16/06/2026
Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration
and execute some commands (e.g. system reboot).