Waterfall’s WF‑500 RX Host (v7.9.1.0 R2502171040) contains a relative path traversal flaw, a classic Zip Slip vulnerability described by CWE-23. When a MySQL connector is enabled and file compression is turned on, an attacker who can reach the TX Host can craft a malicious archive that causes the RX Host to write or execute files outside their intended directory. This flaw leads directly to arbitrary code execution on the RX Host, exposing the system to full compromise if the attacker succeeds.

All deployments of Waterfall WF‑500 RX Host running version 7.9.1.0 R2502171040 with a MySQL connector configured and file compression enabled are affected. The flaw resides in the data‑handling code of the RX Host component, impacting only the listed version unless earlier revisions contain the same logic.

The CVSS score of 7.5 indicates a high severity flaw. EPSS data is not available and the vulnerability is not listed in CISA KEV, so application of exploitation data is uncertain. The attack vector requires an attacker to have network access to the TX Host, so those who can reach the TX side pose a significant risk. Successful exploitation would give the attacker full control over the RX Host, allowing deployment of malware, data exfiltration, or disruption of services.