Radiflow iSAP Smart Collector version 3.07-1 contains an OS command injection vulnerability (CWE-78) in its REST API accessible via the management network. The API is token-authenticated, but an attacker with valid authentication can send crafted requests that result in arbitrary commands being executed by the underlying operating system with administrative permissions. This vulnerability allows full control over the device's OS, leading to complete compromise.

Successful exploitation allows an authenticated attacker to execute arbitrary commands with administrative privileges on the affected device. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of device availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the management network and ensure that only trusted administrators have token authentication credentials. Monitor for unusual activity on the management interface.