CVE-2026-22313: OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the REST API/webserver is not required for operations, disable it to remove the attack surface. If it is required, limit exposed endpoints to the minimum necessary.
Radiflow iSAP Smart Collector REST API REST API / webserver = disabled (if not required) - Configuration
Ensure API tokens are constrained to the minimum privileges needed (avoid using administrative tokens for routine access) and reduce token lifetime/validity where possible to limit exposure if a token is compromised.
Radiflow iSAP Smart Collector REST API authentication API token privileges and lifetime = least privilege; reduced lifetime - Compensating control
Restrict network access to the device's management REST API: enforce firewall/ACL rules or VLAN segmentation so only trusted management hosts and IP ranges can reach the iSAP Smart Collector webserver on the management network.
- Compensating control
Deploy request-level protections (WAF/IDS/IPS or input validation) in front of the REST API to detect and block command-injection payloads and suspicious command execution patterns on the management network.
- Operational
Revoke and rotate all existing authentication tokens used for the REST API; invalidate current tokens and reissue new tokens after applying network restrictions or other mitigations.