CVE-2025-41265
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
An OS command injection vulnerability (CWE-78) was identified in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040. It allows remote authenticated attackers to execute arbitrary operating system commands on the device.
Risk Assessment
An attacker can gain full control over the device, compromising data confidentiality, integrity, and availability, and potentially spreading the attack within the network.
Recommendation
Immediately update the Waterfall WF-500 TX Host software to the latest available version that fixes this vulnerability. Until then, restrict access to the administration interface to trusted IP addresses only.
Other vulnerabilities in Waterfall WF-500 TX Host
See all- CVE-2025-41267High
An OS command injection vulnerability (CWE-78) was identified in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040. It allows remote authenticated attackers to execute arbitrary operating system commands on the device.
- CVE-2025-41266High
An OS command injection vulnerability (CWE-78) was identified in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040. It allows remote authenticated attackers to execute arbitrary operating system commands on the device.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.