CVE-2025-3498 is a critical vulnerability affecting Radiflow's iSAP Smart Collector version 1.20, a device running on CentOS 7 with VSAP 1.20. The vulnerability arises due to missing authentication controls on two web servers that expose REST APIs on the management network via TCP ports 8084 and 8086. These REST APIs allow unauthenticated users with access to the management network to retrieve and modify the device's configuration settings. Furthermore, attackers can execute certain commands, including system reboot, through these APIs. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), indicating that critical functions are accessible without proper authentication. The CVSS v3.1 base score is 9.9 (critical), reflecting the high impact and ease of exploitation: no privileges or user interaction are required, and the attack vector is network-based. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable system, potentially impacting confidentiality, integrity, and availability. Although no known exploits are reported in the wild yet, the severity and nature of the vulnerability make it a significant risk, especially in industrial or critical infrastructure environments where Radiflow devices are deployed. Attackers with management network access can fully control device configurations, potentially disrupting monitoring, data collection, or operational processes dependent on the iSAP Smart Collector.

For European organizations, particularly those in critical infrastructure sectors such as energy, utilities, and industrial control systems, this vulnerability poses a severe risk. Radiflow's iSAP Smart Collector is used for network monitoring and security in operational technology (OT) environments. Unauthorized configuration changes could lead to data manipulation, loss of monitoring visibility, or denial of service through device reboot. This can disrupt operational continuity, cause safety hazards, or facilitate further attacks by masking malicious activities. Confidentiality is at risk as attackers can access sensitive system settings. Integrity is compromised due to the ability to modify configurations, potentially falsifying monitoring data or disabling security controls. Availability is affected by the capability to reboot the device, causing service interruptions. Given the critical role of such devices in industrial networks, exploitation could have cascading effects on broader infrastructure and services. The lack of authentication on management interfaces increases the attack surface, especially if network segmentation is weak or management networks are accessible beyond strictly controlled environments.

Immediate mitigation should focus on restricting access to the management network where the vulnerable Radiflow iSAP Smart Collector devices reside. Network segmentation must be enforced to ensure only authorized personnel and systems can reach TCP ports 8084 and 8086. Implement strict firewall rules and access control lists (ACLs) to block unauthorized access. Monitoring and logging of access attempts to these ports should be enhanced to detect suspicious activity. Since no patch is currently available, consider deploying compensating controls such as VPNs with strong authentication for management access or jump hosts that enforce multi-factor authentication. Where possible, disable or restrict the vulnerable REST APIs until a vendor patch is released. Organizations should engage with Radiflow for updates and apply patches promptly once available. Additionally, conduct thorough audits of device configurations and network architecture to identify and remediate any exposure of management interfaces to untrusted networks. Incident response plans should be updated to address potential exploitation scenarios involving these devices.