CVE-2026-22312 — Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modi…
Published: 2026-06-16 · CVSS: 8.6 · CVSS 3.1
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7