Which versions of Waterfall WF-500 are affected by EUVD-2025-209993?

Waterfall WF-500 gateway controllers contain a critical authentication bypass in the Console WebUI (v7.9.1.0 R2502171040) allowing unauthenticated remote attackers to execute privileged actions on…

How to fix or mitigate EUVD-2025-209993?

Within 24 hours: Inventory all Waterfall WF-500 instances; restrict Console WebUI network access to dedicated, air-gapped administrative networks with firewall rules. Within 7 days: Contact Waterfall Networks for patch timeline and interim mitigation guidance; implement IP whitelisting and enhanced logging on all WebUI access. Within 30 days: Apply vendor patch immediately upon release to all affected devices; conduct forensic review of WebUI access logs since deployment to detect unauthorized activity.

Waterfall WF-500 EUVD-2025-209993

Q: What is the CVSS score of EUVD-2025-209993?

EUVD-2025-209993 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-41273 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-05-29 Nozomi

GHSA-7gp3-r9h9-v4j9

Authentication Bypass Wf 500

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:26 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

9.3 (CRITICAL)

CVE Published

May 29, 2026 - 10:53 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to bypass authentication of the Console web application and perform actions as an authenticated user.

AnalysisAI

Authentication bypass in Waterfall WF-500 TX and RX Hosts version 7.9.1.0 R2502171040 allows remote unauthenticated attackers to perform privileged actions through the Console WebUI via an alternate path or channel. Discovered by Nozomi Networks Labs, the flaw scores CVSS 9.3 (Critical) under v4.0 with network attack vector and no privileges required, though EPSS is low at 0.14% (34th percentile) and no public exploit identified at time of analysis. Given Waterfall's role in OT/ICS unidirectional gateway deployments, successful exploitation of the management console could enable adversaries to manipulate security-critical configurations.

Technical ContextAI

Waterfall WF-500 is a hardware data diode / unidirectional security gateway commonly deployed at IT/OT boundaries to enforce one-way data transfer between operational technology networks and corporate or external networks. The Console WebUI is the management plane used to configure and monitor the appliance. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel), meaning the web application enforces authentication on its primary entry points but exposes a secondary route - such as an alternate URL, API endpoint, or protocol handler - that performs sensitive actions without re-validating the caller's identity. CPE coverage is cpe:2.3:a:waterfall:wf-500 for the affected appliance software.

RemediationAI

No vendor-released patch version is identified in the available input data at time of analysis; consult the Nozomi Labs advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41273 and the corresponding Waterfall vendor bulletin for the fixed build, and upgrade WF-500 TX and RX Hosts beyond 7.9.1.0 R2502171040 once available. Until a fix is applied, restrict network reachability of the Console WebUI to a dedicated management VLAN or jump host (trade-off: legitimate remote administration must be tunneled through that path), block inbound TCP to the management interface from any production, OT process, or untrusted network at the perimeter firewall, and monitor WebUI access logs for unauthenticated requests to non-standard paths or API endpoints that may indicate bypass attempts. Avoid exposing the management interface to the internet under any circumstances.