Information Disclosure Vulnerability in Radiflow iSAP Smart Collector

CVE-2025-27028

What is CVE-2025-27028?

A deprivileged user account, vpuser, in the Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) has been found to possess the ability to read sensitive content across the entire file system. This includes access to files owned by other users and even files that are typically restricted, such as the root password hash. This vulnerability raises significant security concerns, as unauthorized access to sensitive information can lead to further exploitation and compromise of the system.

References