Skip to main content

Incorrect Privilege Assignment

CVE-2025-27028

Medium
6.8/10

Summary

The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging to other users and having restricted access (like, for example, the root password hash).

  • LOW
  • NETWORK
  • NONE
  • CHANGED
  • NONE
  • HIGH
  • HIGH
  • NONE

CWE-266 - Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References

Advisory Timeline

  • Published