CVE-2026-22313: OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the REST API/webserver is not required for operations, disable it to remove the attack surface. If it is required, limit exposed endpoints to the minimum necessary.
Radiflow iSAP Smart Collector REST API REST API / webserver = disabled (if not required) - Configuration
Ensure API tokens are constrained to the minimum privileges needed (avoid using administrative tokens for routine access) and reduce token lifetime/validity where possible to limit exposure if a token is compromised.
Radiflow iSAP Smart Collector REST API authentication API token privileges and lifetime = least privilege; reduced lifetime - Compensating control
Restrict network access to the device's management REST API: enforce firewall/ACL rules or VLAN segmentation so only trusted management hosts and IP ranges can reach the iSAP Smart Collector webserver on the management network.
- Compensating control
Deploy request-level protections (WAF/IDS/IPS or input validation) in front of the REST API to detect and block command-injection payloads and suspicious command execution patterns on the management network.
- Operational
Revoke and rotate all existing authentication tokens used for the REST API; invalidate current tokens and reissue new tokens after applying network restrictions or other mitigations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22313?
CVE-2026-22313 has a severity score of 9.1, indicating a critical vulnerability.
How can I mitigate CVE-2026-22313?
To protect against CVE-2026-22313, ensure that your Radiflow iSAP Smart Collector is updated to the latest version with security patches.
Who is affected by CVE-2026-22313?
Organizations using Radiflow iSAP Smart Collector with exposed REST APIs on management networks are at risk from CVE-2026-22313.
What type of attack can exploit CVE-2026-22313?
CVE-2026-22313 can be exploited through OS command injection by an authenticated attacker sending malicious commands to the device.
What are the potential impacts of CVE-2026-22313?
Exploitation of CVE-2026-22313 could allow unauthorized access and control over the affected device with administrative privileges.