Nozomi Networks Labs reported an OS Command Injection flaw in the Administration WebUI of the Waterfall WF‑500 TX Host, identified as CWE‑78. The vulnerability permits a remote authenticated attacker to supply input that is unsafely added to operating‑system commands, enabling the execution of arbitrary commands on the device. If exploited, the attacker could gain full control of the device, compromise the hostname, and potentially access or modify any data stored on the host.

Waterfall “Waterfall WF‑500” TX Host, version 7.9.1.0 R2502171040, is affected. The issue resides in the administrative web interface exposed to authenticated users on this specific build.

The CVSS score for this vulnerability is 8.6, indicating a high severity rating. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires authentication and is accessible via the remote Administration WebUI, an attacker who can gain or already possesses valid credentials can exploit the command injection by crafting malicious input within that authenticated session. This could lead to remote code execution and full system compromise, though no public exploit has been reported at this time.