CVE-2025-3498
Published: 09 July 2025
Summary
CVE-2025-3498 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Gov (inferred from references). Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-3498 is a critical vulnerability in the Radiflow iSAP Smart Collector running on CentOS 7 with VSAP 1.20. It stems from two web servers exposing unauthenticated REST APIs on the management network over TCP ports 8084 and 8086, enabling an unauthenticated user to retrieve and modify the device's full configuration. Classified under CWE-306 (Missing Authentication for Critical Function), the flaw carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) and was published on 2025-07-09.
An attacker requires only network access to the management interface to exploit this vulnerability without authentication. Successful exploitation grants read access to all system settings, the ability to modify configurations, and execution of certain commands, such as rebooting the system, which could disrupt operations or enable further compromise.
Mitigation guidance is available in the advisory published by CVCN at https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20795
Vulnerability details
An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084…
more
and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration and execute some commands (e.g., system reboot).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated REST API exposure on network-accessible web servers directly enables remote exploitation of a public-facing application without credentials (CWE-306).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates limiting and documenting actions permitted without authentication, addressing the exposure of unauthenticated REST APIs allowing configuration read/modify/execution.
Enforces approved authorizations for logical access to system resources, preventing unauthorized configuration changes and command execution via the exposed APIs.
Monitors and controls communications at managed network boundaries, restricting unauthorized access to management network ports 8084 and 8086.