CVE-2025-3498 (GCVE-0-2025-3498)

Vulnerability from cvelistv5 – Published: 2025-07-09 08:53 – Updated: 2025-07-09 13:20
VLAI?
Summary
An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration and execute some commands (e.g., system reboot).
Severity ?
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
CWE
  • CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
Vendor Product Version
Radiflow iSAP Smart Collector Affected: 1.20 , < 3.02-1 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3498",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-09T13:11:11.122063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-09T13:20:55.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "iSAP Smart Collector",
          "vendor": "Radiflow",
          "versions": [
            {
              "lessThan": "3.02-1",
              "status": "affected",
              "version": "1.20",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\nAn unauthenticated user with management network access can get and \nmodify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) \nconfiguration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration\nand execute some commands (e.g., system reboot).\u003cbr\u003e\u003c/span\u003e"
            }
          ],
          "value": "An unauthenticated user with management network access can get and \nmodify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) \nconfiguration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration\nand execute some commands (e.g., system reboot)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-09T08:53:32.653Z",
        "orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
        "shortName": "ENISA"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated modification of Radiflow iSAP Smart Collector configuration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
    "assignerShortName": "ENISA",
    "cveId": "CVE-2025-3498",
    "datePublished": "2025-07-09T08:53:32.653Z",
    "dateReserved": "2025-04-10T08:40:13.779Z",
    "dateUpdated": "2025-07-09T13:20:55.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-3498\",\"sourceIdentifier\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"published\":\"2025-07-09T09:15:27.137\",\"lastModified\":\"2025-07-10T13:17:30.017\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An unauthenticated user with management network access can get and \\nmodify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) \\nconfiguration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\\nports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration\\nand execute some commands (e.g., system reboot).\"},{\"lang\":\"es\",\"value\":\"Un usuario no autenticado con acceso a la red de administraci\u00f3n puede obtener y modificar la configuraci\u00f3n de Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20). El dispositivo cuenta con dos servidores web que exponen API REST no autenticadas en la red de administraci\u00f3n (puertos TCP 8084 y 8086). Un atacante puede usar estas API para acceder a toda la configuraci\u00f3n del sistema, modificar la configuraci\u00f3n y ejecutar algunos comandos (p. ej., reiniciar el sistema).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L\",\"baseScore\":9.9,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":5.3}]},\"weaknesses\":[{\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"}]}],\"references\":[{\"url\":\"https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498\",\"source\":\"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-3498\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-09T13:11:11.122063Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-09T13:12:59.132Z\"}}], \"cna\": {\"title\": \"Unauthenticated modification of Radiflow iSAP Smart Collector configuration\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 9.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Radiflow\", \"product\": \"iSAP Smart Collector\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.20\", \"lessThan\": \"3.02-1\", \"versionType\": \"semver\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498\", \"tags\": [\"government-resource\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An unauthenticated user with management network access can get and \\nmodify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) \\nconfiguration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\\nports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration\\nand execute some commands (e.g., system reboot).\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\\nAn unauthenticated user with management network access can get and \\nmodify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) \\nconfiguration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\\nports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration\\nand execute some commands (e.g., system reboot).\u003cbr\u003e\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\"}]}], \"providerMetadata\": {\"orgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"shortName\": \"ENISA\", \"dateUpdated\": \"2025-07-09T08:53:32.653Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-3498\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-09T13:20:55.438Z\", \"dateReserved\": \"2025-04-10T08:40:13.779Z\", \"assignerOrgId\": \"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158\", \"datePublished\": \"2025-07-09T08:53:32.653Z\", \"assignerShortName\": \"ENISA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.