CVE-2025-41266 Waterfall CVE debrief

Who should care

Organizations deploying Waterfall WF-500 TX Host devices in industrial control system (ICS) or operational technology (OT) environments should prioritize assessment and remediation. Security teams responsible for OT/ICS network security, asset owners in critical infrastructure sectors, and administrators managing Waterfall Security unidirectional gateway products are directly affected. The authenticated nature of this vulnerability means organizations with strong administrative access controls face reduced but not eliminated risk.

Technical summary

The Waterfall WF-500 TX Host firmware version 7.9.1.0 R2502171040 contains an OS command injection vulnerability (CWE-78) in its Administration WebUI. The flaw arises from improper neutralization of special elements used in OS commands. An attacker with administrative privileges can remotely inject and execute arbitrary operating system commands on the host. The vulnerability requires high privileges (administrative access) but no user interaction, with low attack complexity. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Defensive priority

HIGH

Recommended defensive actions

• Restrict administrative access to the WF-500 TX Host Administration WebUI to trusted networks and authorized personnel only.
• Apply firmware updates from Waterfall Security when available to address the command injection vulnerability.
• Monitor WebUI access logs for anomalous administrative activity or unexpected command execution patterns.
• Implement network segmentation to limit exposure of the WF-500 TX Host Administration WebUI to untrusted networks.
• Review and validate input sanitization mechanisms in WebUI components as part of defense-in-depth.

Evidence notes

The vulnerability is classified as CWE-78 (OS Command Injection) per the primary weakness source. The affected product is the Waterfall WF-500 TX Host with firmware version 7.9.1.0 R2502171040 and earlier, as specified in NVD CPE criteria. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no attack requirements, high privileges required, no user interaction, and high impacts to confidentiality, integrity, and availability of the vulnerable system. The hardware component (WF-500) is marked as not vulnerable, while the firmware is the vulnerable component.

Official resources