Waterfall’s WF-500 TX and RX hosts allow an unauthenticated attacker to exploit a relative path traversal flaw in the console’s WebUI, enabling the reading of arbitrary files on the device. This results in a confidentiality compromise and allows attackers to view sensitive configuration or system files. It is a purely read‑only impact with no direct execution or modification possible, but the disclosed paths can expose privileged data.

The affected devices are Waterfall WF-500 TX and RX hosts running firmware version 7.9.1.0 R2502171040.

The CVSS score of 8.7 reflects a high severity risk, indicating that exploitation would be straightforward if the vulnerable device is reachable. The probability of exploitation is unknown. No known mass exploitation has been reported, as the issue is not listed in CISA KEV. Attackers can reach the vulnerable endpoint remotely via the console WebUI, and no authentication is required, making it an immediate threat for devices exposed to untrusted networks.