CVE-2025-3499 - Vulnerability Details - OpenCVE

The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Radiflow	Isap Smart Collector

No data.

No data.

References

Link	Providers
https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00321}`	epss `{'score': 0.00453}`

Wed, 09 Jul 2025 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 09 Jul 2025 09:15:00 +0000

Type	Values Removed	Values Added
Description		The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.
Title		Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector
Weaknesses		CWE-78
References		https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ENISA

Published: 2025-07-09T08:57:26.893Z

Updated: 2025-07-09T13:08:05.257Z

Reserved: 2025-04-10T08:40:15.892Z

Link: CVE-2025-3499

Vulnrichment

Updated: 2025-07-09T13:07:54.556Z

NVD

Status : Awaiting Analysis

Published: 2025-07-09T09:15:27.297

Modified: 2025-07-10T13:17:30.017

Link: CVE-2025-3499

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3499", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "state": "PUBLISHED", "assignerShortName": "ENISA", "dateReserved": "2025-04-10T08:40:15.892Z", "datePublished": "2025-07-09T08:57:26.893Z", "dateUpdated": "2025-07-09T13:08:05.257Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "iSAP Smart Collector", "vendor": "Radiflow", "versions": [{"lessThan": "3.02-1", "status": "affected", "version": "1.20", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\nThe device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary\ncommands that are executed with administrative permissions by the underlying operating system.<br></span>"}], "value": "The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary\ncommands that are executed with administrative permissions by the underlying operating system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u2019OS Command Injection\u2019)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2025-07-09T08:57:26.893Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499"}], "source": {"discovery": "UNKNOWN"}, "title": "Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-09T13:06:55.487400Z", "id": "CVE-2025-3499", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-09T13:08:05.257Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-09T13:06:55.487400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-09T13:07:54.556Z"}}], "cna": {"title": "Unauthenticated execution of arbitrary commands in Radiflow iSAP Smart Collector", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Radiflow", "product": "iSAP Smart Collector", "versions": [{"status": "affected", "version": "1.20", "lessThan": "3.02-1", "versionType": "semver"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary\ncommands that are executed with administrative permissions by the underlying operating system.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\nThe device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary\ncommands that are executed with administrative permissions by the underlying operating system.<br></span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u2019OS Command Injection\u2019)"}]}], "providerMetadata": {"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "shortName": "ENISA", "dateUpdated": "2025-07-09T08:57:26.893Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3499", "state": "PUBLISHED", "dateUpdated": "2025-07-09T13:08:05.257Z", "dateReserved": "2025-04-10T08:40:15.892Z", "assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "datePublished": "2025-07-09T08:57:26.893Z", "assignerShortName": "ENISA"}, "dataVersion": "5.1"}