Radiflow iSAP Smart Collector OS Command Injection Vulnerability

A command injection vulnerability has been identified in Radiflow iSAP Smart Collector, specifically in versions running on CentOS 7 with VSAP 1.20. The vulnerability arises from two unauthenticated REST APIs exposed by the device's web servers on TCP ports 8084 and 8086. An attacker with access to the management network can exploit this vulnerability to execute arbitrary commands with administrative privileges on the underlying operating system.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system, with administrative rights.