CVE-2025-41277

Published May 29, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed

Description

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

Analysis

Technical impact

Nozomi Networks Labs identified an OS Command Injection flaw in the Console WebUI of Waterfall WF-500 TX and RX Hosts. The vulnerability, classified as CWE-78, permits remote unauthenticated attackers to inject and execute arbitrary operating system commands. With the ability to run any command at the device’s privilege level, an attacker could fully compromise the device, gaining full confidentiality, integrity, and availability control.

Affected Systems

The affected product is Waterfall:WF-500, specifically the TX and RX Hosts running firmware version 7.9.1.0 R2502171040. No other vendor or product variants are listed as vulnerable in this advisory.

Risk and Exploitability

The CVSS score of 9.3 marks this as a critical vulnerability, with no mitigation information provided in the advisory and the EPSS score of 1%. The attack vector is remote and unauthenticated, likely via the web-based console interface, allowing exploitation without needing credentials. The vulnerability’s impact enables arbitrary command execution, rendering it a severe risk to all devices running the affected firmware.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Waterfall

WF-500

unaffected

Version	Status	Constraints
`0`	affected	≤ 7.9.1.0 R2502171040

Configuration 1 [-]

AND

cpe:2.3:o:waterfall-security:wf-500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:waterfall-security:wf-500:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Waterfall

Wf-500

Version	Status	Scheme	Platform
`[0,7.9.1.0 R2502171040]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the device firmware to a version that contains the OS command injection fix, as provided by Waterfall or Nozomi Networks.
Disable or restrict the Console WebUI so that only trusted internal IP addresses can reach it, for example by configuring firewall rules or VPN access.
Apply network segmentation and isolate affected devices from untrusted networks to limit the blast radius of a potential compromise.

Generated by OpenCVE AI on June 18, 2026 at 07:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.4% (1.380% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41277

History

Jun 18, 2026 4:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Remote OS Command Injection via Waterfall WF-500 Console WebUI

Jun 17, 2026 5:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Remote OS Command Injection via Waterfall WF-500 Console WebUI

Jun 16, 2026 7:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	OS Command Injection Allowing Remote Code Execution on Waterfall WF-500

Jun 1, 2026 7:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Waterfall-security Waterfall-security wf-500 Waterfall-security wf-500 Firmware
CPEs		cpe:2.3:h:waterfall-security:wf-500:-:::::::* cpe:2.3:o:waterfall-security:wf-500_firmware::::::::
Vendors & Products		Waterfall-security Waterfall-security wf-500 Waterfall-security wf-500 Firmware
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

May 29, 2026 4:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Waterfall Waterfall wf-500
Vendors & Products		Waterfall Waterfall wf-500

May 29, 2026 3:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		OS Command Injection Allowing Remote Code Execution on Waterfall WF-500

May 29, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 29, 2026 11:45 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.
Weaknesses		CWE-78
References		https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41277
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`