Which versions of Waterfall WF-500 are affected by CVE-2025-41271?

Waterfall WF-500 TX/RX Hosts version 7.9.1.0 R2502171040 contains an arbitrary file read vulnerability allowing unauthenticated remote attackers to access sensitive system files through the Console…

How to fix or mitigate CVE-2025-41271?

24 hours: Identify all Waterfall WF-500 TX/RX Hosts running version 7.9.1.0 R2502171040 and document affected systems. 7 days: Implement firewall rules and network segmentation restricting Console WebUI access to authorized administrative networks only; disable WebUI remote access if not operationally required. 30 days: Monitor Waterfall vendor security advisories for patch availability; establish upgrade plan once patched versions are released and tested.

Waterfall WF-500 CVE-2025-41271

Q: What is the CVSS score of CVE-2025-41271?

CVE-2025-41271 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-209991 HIGH

Relative Path Traversal (CWE-23)

2026-05-29 Nozomi

GHSA-8jh5-3w8c-rv2j

Path Traversal Wf 500

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:26 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.7 (HIGH)

CVE Published

May 29, 2026 - 10:51 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device.

AnalysisAI

Arbitrary file read in Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040 allows remote unauthenticated attackers to retrieve sensitive files from the device through a path traversal flaw in the Console WebUI. Discovered and disclosed by Nozomi Networks Labs, the issue scores CVSS 4.0 8.7 with network attack vector and no privileges required, though no public exploit identified at time of analysis and the device is not currently listed in CISA KEV.

Technical ContextAI

Waterfall WF-500 is a unidirectional security gateway appliance (TX/RX host pair) used predominantly in OT/ICS environments to enforce one-way data flow between trust zones such as control networks and corporate IT. The vulnerability resides in the Console WebUI management interface and is classified as CWE-23 (Relative Path Traversal), meaning user-supplied input containing relative path segments such as '../' is incorporated into file system operations without adequate sanitization or canonicalization, permitting access outside the intended web root. Because the WebUI is the administrative front-end of a security-critical boundary device (CPE cpe:2.3:a:waterfall:wf-500), arbitrary file disclosure can expose configuration files, credentials, cryptographic material, and logs that describe the segmented network the gateway protects.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references; operators should contact Waterfall Security Solutions directly and consult the Nozomi Networks advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41271 for the latest fix guidance and any post-7.9.1.0 R2502171040 release. Until a fixed firmware is available, restrict reachability to the Console WebUI by placing the management interface on a dedicated out-of-band management VLAN with ACLs that permit only specific administrator workstations or jump hosts (trade-off: legitimate administrators must use the jump host, slightly increasing operational friction), and consider fronting the WebUI with a reverse proxy or WAF rule that rejects requests whose paths contain '../', '%2e%2e', or other traversal encodings (trade-off: may break legitimate URLs that contain encoded dots). Rotate any credentials, API keys, or certificates stored on the device after patching, since arbitrary file read could have exposed them, and increase log review on the WebUI for anomalous GET requests with traversal sequences.