CVE-2025-41269 - Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device

Back Back to CVE browser

CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device

Published May 29, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 1.38%

Description

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating system commands on the device.

Affected products

Vendor Waterfall Product n/a Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=7.9.1.0 R2502171040

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Waterfall

n/a

unaffected

Version	Status	Constraints
0	affected	<=7.9.1.0 R2502171040

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-209989
Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41269
third-party-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-209989		Advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41269		third-party-advisoryVendor Advisory