CVE-2025-41279

HighCVSS 7.2

Published: 29/05/2026(UTC)Updated: 21/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.88%

55th percentile - higher than 55% of all known CVEs

Summary

CWE-78 (OS Command Injection) vulnerability in the Administration WebUI of Waterfall WF-500 RX Host version 7.9.1.0 R2502171040. A remote authenticated attacker can execute arbitrary operating system commands on the host.

Risk Assessment

The risk for the organization includes full compromise of the Waterfall WF-500 RX Host device, potentially leading to data integrity and confidentiality breaches and network disruption.

Recommendation

It is recommended to immediately update the Waterfall WF-500 RX Host software to the latest patched version and restrict access to the administration interface to trusted users only.

Other vulnerabilities in Waterfall WF-500 RX Host

CVE-2025-41281High
A CWE-78 OS Command Injection vulnerability was identified in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040. Attackers with access to the TX Host can execute code on the RX Host when a MySQL connector is configured.

Original NVD description (English source)

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 RX Host.