Which versions of Waterfall WF-500 are affected by EUVD-2025-210000?

The Waterfall WF-500 RX Host version 7.9.1.0 R2502171040 contains a path traversal vulnerability enabling code execution when the TX Host is compromised and MySQL file compression is enabled,…

How to fix or mitigate EUVD-2025-210000?

24 hours: Identify all WF-500 RX Host v7.9.1.0 deployments with MySQL connectors and file compression enabled; restrict TX Host administrative access to trusted personnel only. 7 days: Contact Waterfall Security for patch timeline and interim guidance; disable MySQL file compression if operationally feasible. 30 days: Apply vendor-released patch immediately upon availability; verify installation across all affected instances.

Waterfall WF-500 EUVD-2025-210000

Q: What is the CVSS score of EUVD-2025-210000?

EUVD-2025-210000 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-41280 HIGH

Relative Path Traversal (CWE-23)

2026-05-29 Nozomi

GHSA-cf86-3f4j-57g9

Path Traversal Wf 500

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 14:23 vuln.today

CVSS changed

May 29, 2026 - 12:22 NVD

7.5 (HIGH)

CVE Published

May 29, 2026 - 10:59 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers with access to the TX Host to execute code on the RX Host when a MySQL connector is configured and file compression is enabled.

AnalysisAI

Relative path traversal (Zip Slip) in Waterfall WF-500 RX Host version 7.9.1.0 R2502171040 enables code execution on the RX side when attackers already control the TX Host and the deployment uses a MySQL connector with file compression enabled. The flaw, tracked as CWE-23 and reported by Nozomi Networks Labs, has no public exploit identified at time of analysis and an EPSS of 0.02% (4th percentile), but it meaningfully undermines the data-diode trust boundary the WF-500 is deployed to enforce.

Technical ContextAI

The Waterfall WF-500 is a unidirectional security gateway (data diode) used to enforce one-way data flow between an OT/source side (TX Host) and a destination side (RX Host), commonly bridging industrial control networks into IT or monitoring environments. CPE cpe:2.3:a:waterfall:wf-500 confirms the affected product. CWE-23 (Relative Path Traversal) manifests here as a classic 'Zip Slip' pattern: the RX Host decompresses archives forwarded across the diode but fails to canonicalize or constrain entry paths inside the archive, so an attacker-controlled entry containing '../' sequences can write files outside the intended extraction directory. The bug surfaces specifically along the MySQL connector pipeline when file compression is enabled, because that path is where the RX-side decompression routine handles attacker-influenced archive contents.

RemediationAI

Patch status is ambiguous in the available data - no vendor-released fixed version is independently identified at time of analysis, so contact Waterfall Security Solutions directly referencing CVE-2025-41280 / EUVD-2025-210000 and consult the Nozomi advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41280 for any updated fixed build of WF-500 beyond 7.9.1.0 R2502171040. Until a vendor patch is applied, the most direct compensating control is to disable file compression on the MySQL connector pipeline, which removes the decompression step that triggers the Zip Slip but will increase bandwidth across the diode for MySQL replication flows; alternatively, avoid the MySQL connector path entirely for untrusted TX-side data and harden the TX Host (least privilege, monitoring, integrity controls) so that the prerequisite TX foothold is harder to obtain. Treat the TX-to-RX trust boundary as compromised in monitoring: alert on unexpected file writes on the RX Host outside expected extraction directories.