Nozomi Networks Labs exposed an OS Command Injection flaw in the Console WebUI of Waterfall WF‑500 devices. The flaw, identified as CWE‑78, allows a remote unauthenticated attacker to inject and execute arbitrary operating‑system commands on the target device. Successful exploitation gives the attacker the ability to run any OS command on the device, thereby providing full control over its operating environment.

The vulnerability affects Waterfall WF‑500 TX and RX hosts running firmware version 7.9.1.0 R2502171040. Devices with this specific build are therefore in the impact set.

The CVSS score of 9.3 signals a critical severity. The EPSS score of 1% indicates a low probability of exploitation, but the high score coupled with a remote unauthenticated vector indicates a significant risk of exploitation, especially for devices exposed to the internet or untrusted networks. The flaw is not listed in the CISA KEV catalog, but the lack of an authentication requirement means attackers can launch attacks simply by sending crafted requests to the WebUI endpoint.