CVE-2025-41274

View on CVE.org
Published May 29, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Description
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

Analysis

AI-generated

Technical impact

Nozomi Networks Labs identified an OS Command Injection flaw in the Console WebUI of Waterfall WF‑500 devices. The vulnerability allows an attacker that can reach the web interface without authentication to supply arbitrary shell commands, which the device executes with system privileges. This flaw is classified as CWE‑78 and can be used to break confidentiality, integrity, and availability of the device and potentially the network it serves.

Affected Systems

The issue exists in Waterfall WF‑500 TX and RX hosts running firmware version 7.9.1.0 R2502171040. Both the TX and RX components expose the vulnerable console web interface.

Risk and Exploitability

The CVSS score of 9.3 indicates critical impact. The EPSS score of 1% indicates a low but non‑zero likelihood of exploitation, and the flaw is not listed in CISA KEV. The lack of authentication requirements means that anyone with network access to the WebUI can exploit it, granting unrestricted control over the operating system on the affected device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware patch from Waterfall that addresses the command injection flaw in the WF-500 console WebUI.
  • Restrict access to the Console WebUI to a trusted IP subnet or require VPN and firewall rules that block unauthenticated traffic.
  • If the console WebUI is not needed for day‑to‑day operations, disable the feature entirely or seal it behind an access‑control list to eliminate the vulnerable component.

Generated by OpenCVE AI on June 18, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title OS Command Injection in Waterfall WF-500 Console WebUI Enables Remote Code Execution
Type Values Removed Values Added
Title OS Command Injection in Waterfall WF-500 Console WebUI Enables Remote Code Execution
Type Values Removed Values Added
First Time appeared Waterfall-security
Waterfall-security wf-500
Waterfall-security wf-500 Firmware
CPEs cpe:2.3:h:waterfall-security:wf-500:-:*:*:*:*:*:*:*
cpe:2.3:o:waterfall-security:wf-500_firmware:*:*:*:*:*:*:*:*
Vendors & Products Waterfall-security
Waterfall-security wf-500
Waterfall-security wf-500 Firmware
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Waterfall
Waterfall wf-500
Vendors & Products Waterfall
Waterfall wf-500
Type Values Removed Values Added
Title Remote OS Command Injection in Waterfall WF-500 Console WebUI
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Remote OS Command Injection in Waterfall WF-500 Console WebUI
Type Values Removed Values Added
Description Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
Earlier changes (3)
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
Nozomi
Published
Updated
May 29, 2026, 1:37 PM
Reserved
Apr 16, 2025, 9:53 AM

View source JSON

Updated
May 29, 2026, 1:37 PM

JSON

Status
Analyzed
Published
May 29, 2026, 12:16 PM
Modified
Jul 21, 2026, 12:10 PM

View source JSON

No data.

Updated
Jun 18, 2026, 4:00 AM

JSON