CVE-2026-22312: Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the hard-coded constant token from the device and configure the REST API to require per-device unique credentials or another strong authentication method. Ensure credentials are not embedded as a constant in firmware or configuration files.
Radiflow iSAP Smart Collector REST API authentication token = not a constant/hard-coded token; use unique per-device credentials or strong authentication - Configuration
Disable any unauthenticated API endpoints or require proper authentication and authorization for all REST API operations to prevent access to system settings, configuration modification, and remote command execution.
Radiflow iSAP Smart Collector REST API unauthenticated endpoints = disabled / require authentication - Compensating control
Restrict network access to the device management/API interface to trusted management networks and IPs (via firewall rules, ACLs, VPN or network segmentation) to prevent access from untrusted networks.
- Operational
Rotate any tokens or credentials that may have been exposed, review access logs for signs of unauthorized access, and verify system integrity after applying fixes.