Radiflow iSAP Smart Collector version 3.07-1 contains an OS command injection vulnerability (CWE-78) in its REST API, which is token-authenticated on the management network. This vulnerability allows an authenticated attacker with high privileges to send arbitrary commands to the device, which are executed by the underlying operating system with administrative rights. The CVSS 3.1 base score is 9.1, reflecting critical impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation enables an authenticated attacker with high privileges to execute arbitrary OS commands with administrative permissions on the affected device. This can lead to full system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of device availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management network and the REST API to trusted administrators only, and monitor for suspicious activity. Do not expose the management interface to untrusted networks.