CVE-2026-22312CWE-798

Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector

High · published June 16, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration

and execute some commands (e.g. system reboot).

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.2th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-06-16T18:19Z
EPSS history
Timeline
  • 16 JUN 18:19Z
    Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
    cvelistv5