CVE-2026-22312: Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the hard-coded constant token from the device and configure the REST API to require per-device unique credentials or another strong authentication method. Ensure credentials are not embedded as a constant in firmware or configuration files.
Radiflow iSAP Smart Collector REST API authentication token = not a constant/hard-coded token; use unique per-device credentials or strong authentication - Configuration
Disable any unauthenticated API endpoints or require proper authentication and authorization for all REST API operations to prevent access to system settings, configuration modification, and remote command execution.
Radiflow iSAP Smart Collector REST API unauthenticated endpoints = disabled / require authentication - Compensating control
Restrict network access to the device management/API interface to trusted management networks and IPs (via firewall rules, ACLs, VPN or network segmentation) to prevent access from untrusted networks.
- Operational
Rotate any tokens or credentials that may have been exposed, review access logs for signs of unauthorized access, and verify system integrity after applying fixes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22312?
The severity of CVE-2026-22312 is rated high with a score of 8.6.
How do I fix CVE-2026-22312?
To fix CVE-2026-22312, it is recommended to update the Radiflow iSAP Smart Collector to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-22312?
CVE-2026-22312 is classified as a Use of Hard-coded Credentials vulnerability.
What impact does CVE-2026-22312 have on the Radiflow iSAP Smart Collector?
CVE-2026-22312 allows unauthenticated attackers to access system settings, modify configurations, and execute commands such as system reboots.
Is the REST API of Radiflow iSAP Smart Collector secure against CVE-2026-22312?
No, the REST API is not secure against CVE-2026-22312 because it utilizes hard-coded credentials that can be exploited by attackers.