Which versions of Waterfall WF-500 are affected by EUVD-2025-209987?

Waterfall WF-500 TX Host version 7.9.1.0 can be compromised by privileged administrators through a command injection vulnerability in the Administration WebUI; the absence of available vendor patches…

How to fix or mitigate EUVD-2025-209987?

Within 24 hours: Inventory all Waterfall WF-500 TX Host systems running version 7.9.1.0 or earlier and restrict Administration WebUI access to essential privileged accounts; enable multi-factor authentication for administrative access if available. Within 7 days: Contact Waterfall support to confirm patch timeline; document current administrative account assignments and implement network segmentation to isolate affected appliances from sensitive systems. Within 30 days: Establish formal patch deployment plan with Waterfall; if patches remain unavailable, evaluate replacement appliances; implement compensating controls including detailed audit logging and SIEM alerting for all administrative actions.

Waterfall WF-500 EUVD-2025-209987

Q: What is the CVSS score of EUVD-2025-209987?

EUVD-2025-209987 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2025-41267 HIGH

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-53qr-g9p4-6gqf

Command Injection Wf 500

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:27 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

8.5 (HIGH)

CVE Published

May 29, 2026 - 10:48 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating system commands on the WF-500 TX Host.

AnalysisAI

Authenticated OS command injection in the Administration WebUI of Waterfall WF-500 TX Host version 7.9.1.0 R2502171040 lets high-privileged remote users execute arbitrary operating system commands on the host. The flaw was identified by Nozomi Networks Labs and carries a CVSS 4.0 score of 8.5, but with no public exploit identified and a modest EPSS of 0.70% (72th percentile), real-world exploitation pressure is currently moderate rather than urgent.

Technical ContextAI

The WF-500 is part of Waterfall Security's unidirectional gateway product line used in OT/ICS environments to enforce one-way data flow between segmented networks. The TX (transmit) Host runs a web-based Administration UI that, per the advisory, fails to neutralize special shell metacharacters in user-supplied input before passing them to an underlying OS command (CWE-78). This pattern typically arises when administrative actions shell out to system utilities (e.g., via system()/exec()/popen()) without strict argument validation or use of parameterized APIs, allowing operator-supplied strings to break out of the intended command context and run attacker-chosen binaries with the privileges of the WebUI backend.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data - operators should contact Waterfall Security directly and monitor the Nozomi advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41267 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-41267 for a fixed build superseding 7.9.1.0 R2502171040. As compensating controls, restrict network reachability of the Administration WebUI to a dedicated management VLAN or jump host so PR:H credentials cannot be exercised from general IT networks (trade-off: operators lose direct browser access and must use the jump host), enforce strong multi-factor authentication and rotate any shared admin credentials to make the PR:H prerequisite harder to satisfy, and instruct administrators to avoid clicking untrusted links or pasting unvetted input into the WebUI to blunt the UI:P requirement. Enable and centrally collect WebUI audit logs and host-level process/exec auditing on the WF-500 TX Host to detect anomalous child processes spawned by the admin web service, which is the most direct indicator of exploitation.