CVE-2025-3497
Published: 09 July 2025
Summary
CVE-2025-3497 is a high-severity Use of Unmaintained Third Party Components (CWE-1104) vulnerability in Gov (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prohibits or requires mitigation for unsupported system components like the EOL CentOS 7 underlying the Radiflow iSAP Smart Collector.
Mandates timely identification, reporting, and remediation of flaws, requiring upgrade or replacement of the EOL OS to address unmitigated vulnerabilities.
Enables ongoing vulnerability scanning to identify exploitable flaws in the unsupported CentOS 7 components before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
EOL/unmaintained OS directly enables remote exploitation of known public vulnerabilities in the underlying CentOS 7 components.
NVD Description
The Linux distribution underlying the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) is obsolete and reached end of life (EOL) on June 30, 2024. Thus, any unmitigated vulnerability could be exploited to affect this product.
Deeper analysisAI
CVE-2025-3497 stems from the use of an obsolete Linux distribution, CentOS 7, underlying the Radiflow iSAP Smart Collector (VSAP 1.20), which reached end of life on June 30, 2024. This end-of-life status, classified under CWE-1104 (Use of Unmaintained Third Party Components), leaves the product vulnerable to any unmitigated vulnerabilities present in the unsupported OS.
The vulnerability has a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H), indicating exploitation is possible over the network with low complexity and no user interaction, but requires high privileges. A successful attack can result in high integrity and availability impacts with a changed scope, though confidentiality remains unaffected.
Mitigation guidance is available in the advisory published at https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3497.
Details
- CWE(s)