CVE-2025-41271 Waterfall CVE debrief

Who should care

Organizations operating Waterfall WF-500 unidirectional gateway or data diode deployments in industrial control system (ICS) or operational technology (OT) environments. Security teams responsible for OT network segmentation, vulnerability management programs covering ICS assets, and incident response functions monitoring for unauthorized file access on critical infrastructure boundary devices.

Technical summary

The Waterfall WF-500 TX and RX Hosts running firmware version 7.9.1.0 R2502171040 contain a relative path traversal vulnerability (CWE-23) in the Console WebUI component. An unauthenticated remote attacker can exploit insufficient input validation to construct requests that traverse the file system, enabling arbitrary file read from the device. The attack requires network access to the WebUI with no authentication credentials. Confidentiality impact to the vulnerable system is rated HIGH per CVSS 4.0; integrity and availability impacts are rated NONE. The vulnerability does not affect downstream system confidentiality, integrity, or availability per the CVSS vector.

Defensive priority

HIGH

Recommended defensive actions

• Restrict network access to the Console WebUI to authorized administrative hosts only; implement network segmentation to prevent untrusted network reachability to WF-500 management interfaces
• Apply vendor-supplied firmware updates when available from Waterfall Security; verify version exceeds 7.9.1.0 R2502171040
• Monitor WebUI access logs for anomalous path traversal patterns including sequences such as '../' or encoded variants in HTTP requests
• Review file system access controls on the device to limit readable paths in the event of traversal exploitation
• Validate that Web application firewalls or reverse proxies in front of the Console WebUI enforce strict input validation and path normalization

Evidence notes

CPE data confirms affected firmware: cpe:2.3:o:waterfall-security:wf-500_firmware:*:*:*:*:*:*:*:* with version end including 7.9.1.0_r2502171040. The hardware platform WF-500 is listed as not vulnerable (cpe:2.3:h:waterfall-security:wf-500:-:*:*:*:*:*:*:*). CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Weakness enumeration: CWE-23 from primary source [email protected].

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.