Which versions of Waterfall WF-500 are affected by CVE-2025-41279?

CVE-2025-41279 affects Waterfall WF-500 RX Host Administration WebUI, introducing a command injection vulnerability that allows high-privilege authenticated users to execute arbitrary code on a…

How to fix or mitigate CVE-2025-41279?

Within 24 hours: Identify and inventory all Waterfall WF-500 deployments running version 7.9.1.0 R2502171040 or earlier; verify access controls limiting administrative console access to trusted personnel and networks. Within 7 days: Tighten network firewall rules restricting WF-500 WebUI access to authorized administrative subnets only; enable comprehensive logging of all administrative sessions and monitor for suspicious commands; check Waterfall security advisories for patch status. Within 30 days: Complete a full audit of administrative access controls and network segmentation for all WF-500 instances; establish a timeline for patching or replacement pending vendor advisory updates.

Waterfall WF-500 CVE-2025-41279

Q: What is the CVSS score of CVE-2025-41279?

CVE-2025-41279 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2025-209999 HIGH

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-mx9m-xgqf-hmqr

Command Injection Wf 500

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:23 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.6 (HIGH)

CVE Published

May 29, 2026 - 10:59 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 RX Host.

AnalysisAI

Authenticated OS command injection in the Waterfall WF-500 RX Host Administration WebUI (version 7.9.1.0 R2502171040) allows attackers with high privileges to execute arbitrary operating system commands on the unidirectional gateway appliance. The flaw was discovered and reported by Nozomi Networks Labs, carries a CVSS 4.0 score of 8.6, and an EPSS of 0.70% (72nd percentile); no public exploit identified at time of analysis. Because WF-500 is deployed as a data-diode between IT and OT/ICS networks, code execution on the RX Host effectively compromises a critical security boundary.

Technical ContextAI

The WF-500 RX (receive) Host is the IT-side endpoint of Waterfall Security Solutions' unidirectional gateway, which uses hardware-enforced one-way transfer to bridge OT/ICS environments to IT networks while blocking inbound traffic. The vulnerability lives in the appliance's Administration WebUI, where user-supplied input is concatenated into an OS command without proper neutralization of shell metacharacters (CWE-78). When the WebUI passes the tainted string to a shell or system() call, attacker-controlled characters such as ';', '|', '`', or '$()' break out of the intended command and run arbitrary commands under whatever account the web service uses. CPE cpe:2.3:a:waterfall:wf-500 confirms the affected component, and the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H shows full confidentiality, integrity, and availability impact on the vulnerable system itself with no scope change to connected segments.

RemediationAI

Patch available per vendor advisory - consult Waterfall Security Solutions directly and the Nozomi Networks Labs advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41279 for the fixed firmware build and upgrade instructions, since a specific fixed version is not enumerated in the available data. Until upgrade, restrict reachability of the WF-500 Administration WebUI to a dedicated out-of-band management network and a small allowlist of jump hosts, which removes the network attack surface but complicates remote administration. Rotate WebUI administrator credentials and enforce unique strong passwords plus MFA where the appliance supports it, since exploitation requires high privileges (PR:H) and credential reuse or shared admin accounts directly enable the attack. Enable verbose audit logging on the WebUI and forward to a SIEM to detect anomalous admin sessions and command-injection payload patterns, accepting the additional log volume as a trade-off.