CVE-2026-22313 — OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector

CVE-2026-22313

OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector PUBLISHED

Description (CNA)

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.

Affected (CNA)

Vendor / product	Versions
Radiflow / iSAP Smart Collector	affected 3.07-1

CWE

CWE-78

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2026-22313

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.