CVE-2025-27027
Medium
Description
A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.
SeverityMedium
CVSS4.1
Exploit probability—
ProductiSAP Smart Collector
PublishedJul 9, 2025
First seenJul 9, 2025
Weakness typeCWE-653CWE-653
How to fix
Update
- Radiflow iSAP Smart Collector3.02-1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Radiflow iSAP Smart Collector | 1.20 ≤ v < 3.02-1 | 3.02-1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.