Which versions of Waterfall WF-500 are affected by CVE-2025-41277?

Waterfall WF-500 data diode gateways (version 7.9.1.0 R2502171040) contain a critical remote command execution vulnerability accessible to unauthenticated network attackers via the Console WebUI,…

How to fix or mitigate CVE-2025-41277?

Within 24 hours: Inventory all Waterfall WF-500 TX/RX systems running version 7.9.1.0 R2502171040; assess Console WebUI network exposure via firewall logs. Within 7 days: Restrict WebUI access to authenticated administrative networks via firewall rules; contact Waterfall Support for security advisory and patch timeline; document executive risk acceptance. Within 30 days: Apply vendor patch immediately upon release; if patch exceeds 30-day timeline, execute contingency plan (network isolation, alternative gateway deployment, or elevated monitoring).

Waterfall WF-500 CVE-2025-41277

Q: What is the CVSS score of CVE-2025-41277?

CVE-2025-41277 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2025-209997 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-8j22-33w4-9cm2

Command Injection Wf 500

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:24 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

9.3 (CRITICAL)

CVE Published

May 29, 2026 - 10:57 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

AnalysisAI

Remote OS command execution in Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040 allows unauthenticated network attackers to run arbitrary operating system commands through the Console WebUI. The flaw, identified by Nozomi Networks Labs and tracked as CVE-2025-41277, carries a CVSS 4.0 base score of 9.3 and represents a critical risk for industrial environments relying on Waterfall's data diode gateways. No public exploit identified at time of analysis, and EPSS sits at 1.02% (78th percentile) indicating elevated but not yet widespread exploitation activity.

Technical ContextAI

The Waterfall WF-500 is a unidirectional security gateway (data diode) used in OT/ICS environments to enforce one-way data flow between segmented networks such as production control systems and corporate IT. The vulnerable component is the Console WebUI, the management interface exposed on the TX (transmit) and RX (receive) hosts. The root cause is CWE-78 (OS Command Injection), meaning user-supplied input reaching a shell or process-execution API is not properly neutralized of metacharacters such as ;, |, &, or backticks, allowing injected commands to be executed by the underlying operating system. The affected CPE is cpe:2.3:a:waterfall:wf-500 covering all versions through 7.9.1.0 R2502171040.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; operators should contact Waterfall Security Solutions directly and consult the Nozomi advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41277 along with the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-41277 for the latest fix availability. As compensating controls, restrict access to the Console WebUI to a dedicated management VLAN reachable only from a hardened jump host, block TCP access to the WebUI port from production OT networks and any IT segments via firewall ACLs, and monitor authentication and HTTP request logs for anomalous parameters containing shell metacharacters; the trade-off is that locking down the WebUI may complicate routine operational tasks performed by ICS engineers and require an out-of-band path for diagnostics. If the WebUI is not required for daily operations, disable the service entirely until a patched firmware is released.