Which versions of Waterfall WF-500 are affected by CVE-2025-41265?

Waterfall WF-500 TX Host version 7.9.1.0 R2502171040 contains an authenticated OS command injection vulnerability (CVSS 8.6) enabling attackers with valid credentials to execute arbitrary commands…

How to fix or mitigate CVE-2025-41265?

Within 24 hours: inventory all Waterfall WF-500 TX Host systems running 7.9.1.0 R2502171040 and immediately restrict WebUI access to explicitly trusted networks and users via firewall rules. Within 7 days: implement network segmentation isolating WF-500 systems from general IT infrastructure, enforce multi-factor authentication (MFA) on all administrative accounts, and enable comprehensive audit logging for all administrative activity and command execution. Within 30 days: contact Waterfall support to confirm patch availability and timeline, evaluate upgrade feasibility to patched versions when released, and conduct formal risk assessment to determine whether continued operation is acceptable pending vendor remediation.

Waterfall WF-500 CVE-2025-41265

Q: What is the CVSS score of CVE-2025-41265?

CVE-2025-41265 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2025-209985 HIGH

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-qq7f-qfjw-fj9f

Command Injection Wf 500

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:29 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.6 (HIGH)

CVE Published

May 29, 2026 - 10:41 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.

AnalysisAI

OS command injection in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040 enables authenticated remote attackers to execute arbitrary operating system commands on the underlying host. The flaw was disclosed by Nozomi Networks Labs and carries a CVSS 4.0 score of 8.6; no public exploit identified at time of analysis, and EPSS exploitation probability is modest at 0.70%.

Technical ContextAI

The Waterfall WF-500 is a TX Host appliance used in unidirectional security gateway deployments common to industrial control and operational technology environments, where data diodes enforce one-way transfers between OT and IT networks. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied input reaching an Administration WebUI handler is concatenated into an operating system command without adequate sanitization or quoting, permitting shell metacharacters to break out of the intended argument context. Because the WebUI runs with elevated privileges to manage the host, injected commands inherit those privileges and execute directly against the appliance OS.

RemediationAI

No vendor-released patch identified at time of analysis from the provided sources; consult the Nozomi Networks Labs advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41265 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2025-41265 for any fixed-version announcements from Waterfall Security Solutions, and contact the vendor directly for a hotfix or updated firmware. Until a fix is confirmed, restrict network reachability of the WF-500 Administration WebUI to a dedicated management VLAN or jump host (trade-off: legitimate administrators must access through the bastion), enforce strong, unique credentials and rotate any shared admin accounts, enable multi-factor authentication on the WebUI if supported, and audit administrative session logs for unexpected command activity. Because the precondition is PR:H, minimizing the number of accounts with WebUI administrative rights provides meaningful risk reduction at low operational cost.