CVE-2026-22312— Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
Possible ATT&CK Techniques 3AI
T1546.001 · Change Default File Association T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Radiflow | iSAP Smart Collector | 3.07-1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-22312
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector
Source: CVE Program / CVE List V5
Vulnerability Description
The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
Radiflow iSAP Smart Collector 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
iSAP Smart Collector是美国Radiflow公司的一个工业网络安全数据采集器。 Radiflow iSAP Smart Collector 3.07-1版本存在信任管理问题漏洞，该漏洞源于使用了硬编码凭证，可能导致未经身份验证的攻击者访问系统设置、修改配置并执行命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Radiflow | iSAP Smart Collector | 3.07-1 | - |
II. Public POCs for CVE-2026-22312
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22312
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-22312 (1)
- 🔗 CVCNthird-party-advisory
IV. Related Vulnerabilities
Same product: iSAP Smart Collector
- CVE-2026-22313
OS Commands Executed with Administrative Permissions in Radi - CVE-2025-3499
Unauthenticated execution of arbitrary commands in Radiflow - CVE-2025-3498
Unauthenticated modification of Radiflow iSAP Smart Collecto - CVE-2025-3497
Radiflow iSAP Smart Collector Linux distribution unmaintaine - CVE-2025-27028
Read access of deprivileged Radiflow iSAP Smart Collector us
Same vendor: Radiflow
- CVE-2026-22313
OS Commands Executed with Administrative Permissions in Radi - CVE-2025-3499
Unauthenticated execution of arbitrary commands in Radiflow - CVE-2025-3498
Unauthenticated modification of Radiflow iSAP Smart Collecto - CVE-2025-3497
Radiflow iSAP Smart Collector Linux distribution unmaintaine - CVE-2025-27028
Read access of deprivileged Radiflow iSAP Smart Collector us
Same weakness: CWE-798
- CVE-2026-74893
openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded - CVE-2026-74892
openssl_encrypt before 1.4.0 Hardcoded Secret Key - CVE-2026-74891
openssl_encrypt before 1.4.0 Hardcoded Database Credentials - CVE-2026-50601
Planet9 Hardcoded Credentials Vulnerability Information - CVE-2026-19901
LB-LINK X-PRO easycwmp hard-coded credentials
V. Comments for CVE-2026-22312
No comments yet