CVE-2025-3498

Critical

Published: 09 July 2025

Published

09 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

EPSS Score 0.0047 64.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3498 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Gov (inferred from references). Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly mandates limiting and documenting actions permitted without authentication, addressing the exposure of unauthenticated REST APIs allowing configuration read/modify/execution.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for logical access to system resources, preventing unauthorized configuration changes and command execution via the exposed APIs.

SC-7 Boundary Protection good match

prevent

Monitors and controls communications at managed network boundaries, restricting unauthorized access to management network ports 8084 and 8086.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated REST API exposure on network-accessible web servers directly enables remote exploitation of a public-facing application without credentials (CWE-306).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An unauthenticated user with management network access can get and modify the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) configuration. The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084…

and 8086). An attacker can use these APIs to get access to all system settings, modify the configuration and execute some commands (e.g., system reboot).

Deeper analysisAI

CVE-2025-3498 is a critical vulnerability in the Radiflow iSAP Smart Collector running on CentOS 7 with VSAP 1.20. It stems from two web servers exposing unauthenticated REST APIs on the management network over TCP ports 8084 and 8086, enabling an unauthenticated user to retrieve and modify the device's full configuration. Classified under CWE-306 (Missing Authentication for Critical Function), the flaw carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L) and was published on 2025-07-09.

An attacker requires only network access to the management interface to exploit this vulnerability without authentication. Successful exploitation grants read access to all system settings, the ability to modify configurations, and execution of certain commands, such as rebooting the system, which could disrupt operations or enable further compromise.

Mitigation guidance is available in the advisory published by CVCN at https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3498.