CVE-2026-22312 describes a security vulnerability in Radiflow iSAP Smart Collector version 3.07-1 where the device's webserver exposes a REST API that uses a hard-coded authentication token. This constant token enables unauthenticated attackers to gain access to sensitive system settings, alter device configurations, and execute certain commands, including rebooting the system. The vulnerability is categorized as CWE-798 (Use of Hard-coded Credentials) and has a CVSS 3.1 base score of 8.6, indicating high severity. There is no vendor advisory or patch information available at this time.

An attacker can exploit the hard-coded token to bypass authentication on the REST API, leading to unauthorized access to system settings and configuration. This can result in unauthorized configuration changes and command execution such as system reboot, potentially disrupting device availability and integrity. Confidentiality impact is low, integrity impact is high, and availability impact is low according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device's management interface to trusted administrators only and monitor for unauthorized access attempts. Avoid exposing the device's REST API to untrusted networks.