Which versions of Waterfall WF-500 are affected by CVE-2025-41266?

The Waterfall WF-500 TX Host Administration WebUI contains an authenticated command injection vulnerability (CVE-2025-41266) that allows high-privileged users to execute arbitrary system commands on…

How to fix or mitigate CVE-2025-41266?

24 hours: Identify all WF-500 TX instances running version 7.9.1.0 R2502171040 in your OT environment and audit current administrator account access. 7 days: Implement network segmentation to restrict WebUI administrative access to designated jump servers or out-of-band management networks; enable detailed audit logging of all WebUI sessions and command execution. 30 days: Establish a monitoring process for vendor security updates; develop and test an upgrade plan to future patched versions; implement multi-factor authentication for all administrative accounts accessing the device.

Waterfall WF-500 CVE-2025-41266

Q: What is the CVSS score of CVE-2025-41266?

CVE-2025-41266 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2025-209986 HIGH

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-865q-qqwj-gwm3

Command Injection Wf 500

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:28 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.6 (HIGH)

CVE Published

May 29, 2026 - 10:48 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.

AnalysisAI

Authenticated OS command injection in the Waterfall WF-500 TX Host Administration WebUI (version 7.9.1.0 R2502171040) allows remote attackers with high privileges to execute arbitrary operating system commands on the underlying host. The flaw was identified by Nozomi Networks Labs and carries a CVSSv4 score of 8.6, but no public exploit identified at time of analysis and EPSS sits at 0.70% (72th percentile), reflecting limited expected exploitation activity against this niche OT/industrial product.

Technical ContextAI

The Waterfall WF-500 is a unidirectional security gateway (data diode) used in industrial and operational technology environments to enforce one-way data flow between segmented networks. The affected component is the Administration WebUI on the TX (transmit) Host, identified by CPE cpe:2.3:a:waterfall:wf-500. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that user-controlled input from the management interface is concatenated into shell commands without sufficient sanitization or use of parameterized execution APIs, allowing shell metacharacters to break out of the intended command context and execute attacker-supplied OS commands under the privileges of the WebUI process.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; operators should consult the Nozomi Networks Labs advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41266 and contact Waterfall Security Solutions directly for a fixed firmware build superseding 7.9.1.0 R2502171040. Until a patched release is confirmed, restrict network access to the WF-500 TX Host Administration WebUI to a dedicated management VLAN or jump host (this is standard OT hygiene and should have minimal side effects), enforce strong unique credentials and MFA on administrative accounts to raise the bar for the required PR:H precondition, rotate any administrator credentials that may have been exposed, and enable monitoring/logging of WebUI command execution and outbound connections from the TX Host so post-exploitation activity (e.g., unexpected shell processes or network beacons) is detected. Avoid exposing the management interface to general IT networks or the internet under any circumstances.