Nozomi Networks Labs identified an OS Command Injection flaw in the Console WebUI of Waterfall WF‑500 TX and RX Hosts running firmware version 7.9.1.0 R2502171040. This flaw, classified as CWE‑78, permits remote attackers who do not need to authenticate to send specially crafted requests that inject operating system commands into the server’s execution context. If an attacker succeeds, they can run arbitrary commands on the device, potentially exposing sensitive data, modifying system configuration, or disrupting normal operation.

The vulnerability affects Waterfall Communications Systems’ WF‑500 TX and RX hosts running firmware 7.9.1.0 R2502171040. No other firmware revisions or product lines are reported as vulnerable in the current advisory.

The CVSS score of 9.3 categorizes this issue as Critical. Because the attack vector is remote and authentication is not required, the risk of exploitation is high. The EPSS score of 1% indicates a low but nonzero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog; however, the combination of a high severity metric and the absence of defensive controls in the WebUI indicates that exploitation is plausible. Based on the description, it is inferred that an attacker would send a crafted HTTP request to the Console WebUI to trigger the injection; if processed, the injected command is executed in the device’s operating system.