CVE-2025-27028CWE-266

Read access of deprivileged Radiflow iSAP Smart Collector user

Medium · published July 9, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
22.9
In the wild
Unconfirmed
What it is

The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging to other users and having restricted access (like, for example, the root password hash).

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 22.9th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-07-09T08:38Z
EPSS history
Timeline
  • 09 JUL 08:38Z
    Read access of deprivileged Radiflow iSAP Smart Collector user
    cvelistv5