CVE-2025-41272

Remote OS Command Injection in Waterfall WF‑500 Console WebUI

View on CVE.org
Published May 29, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Description
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

Analysis

AI-generated

Technical impact

The CVE identifies an OS Command Injection flaw in the web‑based console of Waterfall WF‑500 TX and RX host devices. Input accepted by the console is passed directly to the operating system shell, allowing an attacker who can reach the web interface to execute arbitrary operating‑system commands. The vulnerability exists in firmware version 7.9.1.0 R2502171040.

Affected Systems

Waterfall WF‑500 TX and RX hosts running firmware 7.9.1.0 R2502171040 are affected. These devices provide network interface functionality and are managed via the console web UI.

Risk and Exploitability

The flaw has a CVSS score of 9.3, indicating critical severity. It can be exploited remotely without authentication; only network connectivity to the console interface is required. The EPSS score of 1% suggests a modest likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the ability to execute arbitrary system commands presents high impact.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to a version that includes the OS command injection fix.
  • Restrict access to the console web UI to trusted IP addresses or a dedicated management network.
  • If a firmware update cannot be applied immediately, disable remote console access or restrict it to a firewall‑protected management subnet.

Generated by OpenCVE AI on June 18, 2026 at 03:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Remote OS Command Injection in Waterfall WF‑500 Console WebUI
Type Values Removed Values Added
Title Remote OS Command Injection in Waterfall WF-500 Console WebUI
Type Values Removed Values Added
Title Remote OS Command Injection in Waterfall WF-500 Console WebUI
Type Values Removed Values Added
First Time appeared Waterfall-security
Waterfall-security wf-500
Waterfall-security wf-500 Firmware
CPEs cpe:2.3:h:waterfall-security:wf-500:-:*:*:*:*:*:*:*
cpe:2.3:o:waterfall-security:wf-500_firmware:*:*:*:*:*:*:*:*
Vendors & Products Waterfall-security
Waterfall-security wf-500
Waterfall-security wf-500 Firmware
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Waterfall
Waterfall wf-500
Vendors & Products Waterfall
Waterfall wf-500
Type Values Removed Values Added
Title OS Command Injection Vulnerability in Waterfall WF-500 Console WebUI
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title OS Command Injection Vulnerability in Waterfall WF-500 Console WebUI
Type Values Removed Values Added
Description Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Earlier changes (4)
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
Nozomi
Published
Updated
May 29, 2026, 1:42 PM
Reserved
Apr 16, 2025, 9:53 AM

View source JSON

Updated
May 29, 2026, 1:42 PM

JSON

Status
Analyzed
Published
May 29, 2026, 12:16 PM
Modified
Jul 21, 2026, 12:10 PM

View source JSON

No data.

Updated
Jun 18, 2026, 4:00 AM

JSON