CVE-2025-3499 | The device has two web servers that expose unauthenticated R… | CVSS 10.0 CRITICAL

Description

The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.

Metadata

CVE ID: CVE-2025-3499
State: PUBLISHED
Assigner: ENISA
Reserved: 2025-04-10 08:40 UTC
Published: 2025-07-09 08:57 UTC
Last updated: 2025-07-09 13:08 UTC
Primary CWE: CWE-78
CWE-78: Improper Neutralization of Special Elements used in …
Vendor / Product: Radiflow / iSAP Smart Collector
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Radiflow	iSAP Smart Collector	Linux	1.20 < 3.02-1

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78: Improper Neutralization of Special Elements used in an OS Command (’OS Command Injection’)

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (1)

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499