CVE-2025-3498

{"id": "CVE-2025-3498", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 3.9}]}, "published": "2025-07-09T09:15:27.137", "references": [{"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated user with management network access can get and \nmodify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) \nconfiguration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP\nports 8084 and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration\nand execute some commands (e.g., system reboot)."}, {"lang": "es", "value": "Un usuario no autenticado con acceso a la red de administraci\u00f3n puede obtener y modificar la configuraci\u00f3n de Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20). El dispositivo cuenta con dos servidores web que exponen API REST no autenticadas en la red de administraci\u00f3n (puertos TCP 8084 y 8086). Un atacante puede usar estas API para acceder a toda la configuraci\u00f3n del sistema, modificar la configuraci\u00f3n y ejecutar algunos comandos (p. ej., reiniciar el sistema)."}], "lastModified": "2025-07-10T13:17:30.017", "sourceIdentifier": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}