Radiflow vulnerabilities
We track 5 vulnerabilities in Radiflow products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on June 16, 2026.
Latest Radiflow vulnerabilities
- 9.1 Critical severity
iSAP Smart Collector: Improper Neutralization of Special Elements used in an OS Command
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrati
- 8.6 High severity
iSAP Smart Collector: Use of Hard-coded Credentials
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
- 10.0 Critical severity
iSAP Smart Collector: Improper Neutralization of Special Elements used in an OS Command
The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissi
- 9.9 Critical severity
iSAP Smart Collector: Missing Authentication for Critical Functionality
An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and
- 8.7 High severity
iSAP Smart Collector: Use of Unmaintained Third Party Components
The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on June 30, 2024. Thus, any unmitigated vulnerability could be exploited to affect this product.