CVE-2026-22312: Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector

Synopsis

A hard-coded credentials vulnerability exists in the Radiflow iSAP Smart Collector (version 3.07-1), an industrial network monitoring device. The embedded web server exposes a REST API protected by a constant, unchangeable token, meaning any attacker who can reach the device over the network gains full API access without supplying real credentials. Successful exploitation lets an attacker read system settings, alter the device configuration, and execute commands such as forcing a system reboot. No fix version has been published; HarborGuard tracks this advisory and will surface a patched rebuild as soon as upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the device's web server over the network; the API is exposed remotely via HTTP/HTTPS with no network-layer restriction built into the device itself.

• AuthenticationNot required

  The REST API relies on a constant hard-coded token rather than real authentication, so no valid account or credential is needed to interact with it.

• Victim interactionNot required

  The attacker sends requests directly to the API endpoint; no action from a user or operator on the target device is required.

• Attack complexityDetail

  Exploit complexity is low: the hard-coded token is static and condition-free, making the attack reliable and repeatable without requiring specific timing or environmental setup.

Blast Radius

• Reads device system settings and configuration data exposed through the REST API.
• Overwrites device configuration, potentially redirecting traffic collection, disabling monitoring, or altering OT network visibility.
• Executes privileged commands such as forcing a full system reboot, disrupting continuous monitoring of the industrial network.
• Disrupts availability of the Smart Collector itself, creating blind spots in industrial network oversight.