CVE-2025-41271 - Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device

Back Back to CVE browser

HIGH

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device

Published May 29, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.43%

Description

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to read arbitrary files from the device.

Affected products

Vendor Waterfall Product n/a Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=7.9.1.0 R2502171040

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Waterfall

n/a

unaffected

Version	Status	Constraints
0	affected	<=7.9.1.0 R2502171040

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-23

References (1)

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41271
third-party-advisoryVendor Advisory

Link	Providers	Tags
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-41271		third-party-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Nozomi

Published May 29, 2026

Updated May 29, 2026

Reserved Apr 16, 2025

Link CVE-2025-41271

CISA Vulnrichment

Updated May 29, 2026

NVD

Status Analyzed

Modified Jul 21, 2026

Link CVE-2025-41271

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-41271