Which versions of Waterfall WF-500 are affected by EUVD-2025-209996?

Waterfall WF-500 TX and RX appliances (version 7.9.1.0 R2502171040) contain a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands through…

How to fix or mitigate EUVD-2025-209996?

Within 24 hours: Identify all Waterfall WF-500 TX/RX appliances in your environment and document their network locations and operational criticality. Within 7 days: Implement firewall rules restricting Console WebUI access to trusted administrative networks only; escalate with Waterfall Networks for patch timeline and interim workarounds. Within 30 days: Monitor Waterfall security advisories for patch release; plan and execute immediate patching across all affected systems upon vendor release.

Waterfall WF-500 EUVD-2025-209996

Q: What is the CVSS score of EUVD-2025-209996?

EUVD-2025-209996 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

| CVE-2025-41276 CRITICAL

OS Command Injection (CWE-78)

2026-05-29 Nozomi

GHSA-w3pq-9jqc-2q4g

Command Injection Wf 500

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:24 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

9.3 (CRITICAL)

CVE Published

May 29, 2026 - 10:57 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

AnalysisAI

Remote code execution in Waterfall WF-500 TX and RX Host appliances (version 7.9.1.0 R2502171040) allows unauthenticated network attackers to inject and execute arbitrary OS commands through the Console WebUI. Discovered by Nozomi Networks Labs, the flaw carries a CVSS 4.0 score of 9.3 with no required privileges or user interaction; no public exploit identified at time of analysis, and EPSS sits at 1.02% (78th percentile).

Technical ContextAI

Waterfall WF-500 is an industrial unidirectional security gateway used in OT/ICS environments to enforce one-way data flows between segmented networks (typical of pairs of TX/RX hosts bridging IT and OT zones). The defect is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controllable input reaches an underlying shell or system() invocation in the Console WebUI without proper sanitization or use of safe APIs such as parameterized exec calls. Per the CPE entry cpe:2.3:a:waterfall:wf-500, the management web interface is the attack surface, and a successful injection grants the attacker code execution in the context of the WebUI process on the gateway host.

RemediationAI

No vendor-released patch identified at time of analysis from the provided inputs; consult the Nozomi advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41276 and contact Waterfall Security for a fixed firmware build superseding 7.9.1.0 R2502171040. Until a patched build is applied, restrict network reachability to the Console WebUI by placing it behind a dedicated management VLAN with ACLs that permit only known administrator workstations, block the WebUI TCP port at perimeter and intra-OT firewalls (side effect: remote operators must use jump hosts), and disable the WebUI service entirely if administration can be performed via an out-of-band channel (side effect: loss of in-band GUI management). Monitor the appliance for anomalous outbound connections or new processes spawned from the WebUI service account as a detection compensating control.