CVE-2025-41266
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
An OS command injection vulnerability (CWE-78) was identified in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040. It allows remote authenticated attackers to execute arbitrary operating system commands on the device.
Risk Assessment
An attacker can gain full control of the device, compromising data confidentiality, integrity, and availability, and potentially spreading the attack across the network.
Recommendation
Immediately update the Waterfall WF-500 TX Host software to the latest patched version. Until then, restrict administrative interface access to trusted IP addresses only.
Other vulnerabilities in Waterfall WF-500 TX Host
See all- CVE-2025-41267High
An OS command injection vulnerability (CWE-78) was identified in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040. It allows remote authenticated attackers to execute arbitrary operating system commands on the device.
- CVE-2025-41265High
An OS command injection vulnerability (CWE-78) was identified in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040. It allows remote authenticated attackers to execute arbitrary operating system commands on the device.
Original NVD description (English source)
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.