PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-41274 Waterfall CVE debrief

A critical OS command injection vulnerability (CWE-78) in Waterfall WF-500 TX and RX Hosts allows remote unauthenticated attackers to execute arbitrary operating system commands via the Console WebUI. The vulnerability affects firmware version 7.9.1.0 R2502171040 and was disclosed by Nozomi Networks Labs. The CVSS 4.0 vector indicates network attack vector with low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability of the victim device.

Vendor
Waterfall
Product
WF-500
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-21
Advisory published
2026-05-29
Advisory updated
2026-07-21

Who should care

Organizations deploying Waterfall WF-500 unidirectional gateway or data diode products in critical infrastructure, industrial control system (ICS), or operational technology (OT) environments. Security teams responsible for network segmentation, patch management, and remote access controls for OT security appliances.

Technical summary

The Waterfall WF-500 TX and RX Hosts firmware version 7.9.1.0 R2502171040 contains an OS command injection vulnerability in its Console WebUI. The flaw stems from improper neutralization of special elements (CWE-78), enabling remote unauthenticated attackers to inject and execute arbitrary operating system commands on the affected device. Successful exploitation grants complete control over the host with high impact to confidentiality, integrity, and availability. The attack requires network access to the WebUI but no authentication or user interaction.

Defensive priority

critical

Recommended defensive actions

  • Restrict network access to the WF-500 Console WebUI to authorized administrative hosts only; do not expose the management interface to untrusted or internet-facing networks.
  • Apply vendor-supplied firmware updates for WF-500 TX and RX Hosts when available; contact Waterfall Security for patch status if running version 7.9.1.0 R2502171040.
  • Monitor WebUI access logs for anomalous requests or unexpected command execution patterns that may indicate exploitation attempts.
  • Segment WF-500 management interfaces from operational technology (OT) networks to limit lateral movement in case of compromise.
  • Review and validate input sanitization on all WebUI endpoints as a defense-in-depth measure during patch verification.

Evidence notes

Vulnerability identified by Nozomi Networks Labs. CPE criteria confirm affected firmware version 7.9.1.0_r2502171040 on WF-500 hardware. NVD status is 'Analyzed'. No KEV listing present.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-41274 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-41274

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-41274 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-41274

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.