An unauthenticated configuration modification vulnerability in the Radiflow iSAP Smart Collector allows unauthorized users to compromise device settings.

Unauthenticated users with access to the management network can retrieve and modify device configurations, likely due to exposed web services or APIs lacking proper access controls.

The ability to modify device configurations allows an attacker to alter the operational behavior of the iSAP Smart Collector, potentially leading to data interception or total service disruption. With a CVSS score of 9.9, this vulnerability poses a severe threat to operational technology environments and industrial control networks.

Immediate Action: Update the iSAP Smart Collector to the latest secure version provided by Radiflow to address the unauthorized configuration access flaw.

Proactive Monitoring: Audit configuration logs for unauthorized changes and monitor management network traffic for irregular access attempts.

Compensating Controls: Use strict network segmentation to ensure that the management interface for the iSAP Smart Collector is not reachable from untrusted network segments.

Public Exploit Available: Not specified

Immediate remediation is critical for this high-severity configuration vulnerability. Organizations should prioritize updating the affected Radiflow units and ensure that management interfaces are strictly guarded to prevent unauthorized access.