CVE-2025-3498 - CVE House
Back to Database
Status published Critical CVE-2025-3498

Unauthenticated modification of Radiflow iSAP Smart Collector configuration

Vulnerability Description

An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration and execute some commands (e.g., system reboot).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3498

Credits & Attribution

No credits recorded in the NVD database.

References

More from Radiflow

View All →
CVE-2025-3499
Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector
Critical 10
CVE-2025-3497
Radiflow iSAP Smart Collector Linux distribution unmaintained
High 8.7
CVE-2025-27028
Read access of deprivileged Radiflow iSAP Smart Collector user
Medium 6.8
CVE-2025-27027
Restricted shell evasion in Radiflow iSAP Smart Collector
Medium 4.1

Affected Vendor

Affected Software

iSAP Smart Collector
Vulnerable Versions:
1.20

Timeline

Official Publish: July 9th, 2025
Last Modified: July 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement