CVE-2025-27028

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging to other users and having restricted access (like, for example, the root password hash).

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Jul 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-270297.5Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.CVE-2025-27036.8The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in or CVE-2025-270306.1information disclosure while invoking calibration data from user space to update firmware size.CVE-2025-270317.8memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.CVE-2025-270327.8memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.CVE-2025-270336.1Information disclosure while running video usecase having rogue firmware.CVE-2025-270349.8Memory corruption while selecting the PLMN from SOR failed list.CVE-2025-270366.1Information disclosure when Video engine escape input data is less than expected minimum size.CVE-2025-270377.8Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.CVE-2025-270387.5Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.CVE-2025-270396.6Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.CVE-2025-27047.5OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting