Which versions of Waterfall WF-500 are affected by EUVD-2025-209989?

Waterfall WF-500 TX and RX Host systems (versions up to 7.9.1.0 R2502171040) are vulnerable to unauthenticated remote code execution via the Console WebUI, enabling attackers to execute arbitrary…

How to fix or mitigate EUVD-2025-209989?

24 hours: Conduct inventory of all WF-500 TX/RX systems in production; verify which systems are running version 7.9.1.0 R2502171040 or earlier; assess WebUI network exposure (direct internet access vs. segmented). 7 days: Implement network segmentation restricting Console WebUI access to dedicated administrative networks only; deploy IDS/IPS detection rules for WebUI exploitation attempts; enable comprehensive audit logging. 30 days: Monitor Waterfall security advisories for patch release; identify and test upgrade path to patched version when available; conduct forensic assessment for any exploitation indicators.

Waterfall WF-500 EUVD-2025-209989

Q: What is the CVSS score of EUVD-2025-209989?

EUVD-2025-209989 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

| CVE-2025-41269 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-5wvf-5xh4-3whx

Command Injection Wf 500

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:27 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

9.3 (CRITICAL)

CVE Published

May 29, 2026 - 10:50 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

AnalysisAI

Remote command execution in Waterfall WF-500 TX and RX Hosts (version 7.9.1.0 R2502171040) allows unauthenticated network attackers to run arbitrary operating system commands via the Console WebUI. The flaw was disclosed by Nozomi Networks Labs and carries a CVSS 4.0 score of 9.3, but no public exploit identified at time of analysis and EPSS sits at 1.02% (78th percentile), indicating credible but not yet widespread exploitation pressure.

Technical ContextAI

The Waterfall WF-500 is a unidirectional security gateway (data diode) product family used in industrial and OT environments to enforce one-way data flow between segmented networks; the TX and RX Hosts are the transmit/receive endpoints managed through a web-based Console. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controllable input reaches a shell or command interpreter inside the Console WebUI without proper sanitization or argument separation. Because the affected component is the management plane exposed over HTTP(S), injected metacharacters or argument-style payloads are executed in the context of the underlying operating system process running the WebUI on the device.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; operators should consult Waterfall Security Solutions directly and monitor the Nozomi advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41269 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-41269 for a fixed build superseding 7.9.1.0 R2502171040. As compensating controls until a fixed version is installed, restrict network access to the Console WebUI to a dedicated management VLAN or jump host using firewall ACLs so the management interface is unreachable from process/IT networks (trade-off: out-of-band administration only, no remote support from non-management subnets); place the WebUI behind a reverse proxy or VPN that enforces strong authentication and TLS client certificates (trade-off: added operational complexity and one more component to maintain); disable or block the Console WebUI service entirely on TX and RX Hosts where day-to-day administration can be performed via local console or CLI (trade-off: loss of GUI-based monitoring and configuration). Increase logging and alerting on the WebUI process for unusual child-process creation and outbound connections from the appliance, since CWE-78 exploitation typically spawns shell commands that are observable in OS-level audit logs.